{"record":{"id":"b7b28f07fb1564d5","repo":"1Panel-dev/1Panel","slug":"create-certificates-pool-v","errorCode":null,"errorMessage":"create certificates pool: %v","messagePattern":"create certificates pool: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agent/utils/ssl/acme.go","lineNumber":294,"sourceCode":"\tconfig.UserAgent = \"1Panel\"\n\tconfig.HTTPClient = createHTTPClientWithProxy(proxyURL, proxyUser, proxyPassword)\n\tconfig.Certificate.Timeout = 60 * time.Second\n\treturn config\n}\n\nfunc initCertPool() *x509.CertPool {\n\tcustomCACertsPath := os.Getenv(\"LEGO_CA_CERTIFICATES\")\n\tif customCACertsPath == \"\" {\n\t\treturn nil\n\t}\n\n\tuseSystemCertPool, _ := strconv.ParseBool(os.Getenv(\"LEGO_CA_SYSTEM_CERT_POOL\"))\n\n\tcaCerts := strings.Split(customCACertsPath, string(os.PathListSeparator))\n\n\tcertPool, err := lego.CreateCertPool(caCerts, useSystemCertPool)\n\tif err != nil {\n\t\tpanic(fmt.Sprintf(\"create certificates pool: %v\", err))\n\t}\n\n\treturn certPool\n}\n\nfunc createHTTPClientWithProxy(proxyURL, username, password string) *http.Client {\n\tvar proxyFunc func(*http.Request) (*url.URL, error)\n\tif proxyURL != \"\" {\n\t\tparsedURL, err := url.Parse(proxyURL)\n\t\tif err != nil {\n\t\t\tproxyFunc = http.ProxyFromEnvironment\n\t\t} else {\n\t\t\tif username != \"\" && password != \"\" {\n\t\t\t\tparsedURL.User = url.UserPassword(username, password)\n\t\t\t} else if username != \"\" {\n\t\t\t\tparsedURL.User = url.User(username)\n\t\t\t}\n\t\t\tproxyFunc = http.ProxyURL(parsedURL)","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/1Panel-dev/1Panel/blob/5ac7c808815b0691009cd390414f03471312262f/agent/utils/ssl/acme.go#L276-L312","documentation":"Panic in agent/utils/ssl/acme.go initCertPool when LEGO_CA_CERTIFICATES is set but lego.CreateCertPool fails to build the pool from the listed files — files unreadable, not PEM, or the system pool request failed. It aborts ACME client construction at startup of the SSL flow.","triggerScenarios":"Set env LEGO_CA_CERTIFICATES=/path/ca.pem (possibly with LEGO_CA_SYSTEM_CERT_POOL=true); the path is wrong, the file is not valid PEM, or a listed entry is a directory — CreateCertPool returns err and initCertPool panics.","commonSituations":"Corporate MITM proxy CA installed for ACME calls; typo in the env var; PEM file exported with headers/base64 damage; container where the CA mount is missing.","solutions":["Verify each path in LEGO_CA_CERTIFICATES exists and is a PEM bundle: openssl x509 -in <file> -noout -text","Fix the env var (absolute paths, colon-separated on Linux) or unset it to use the default pool","If LEGO_CA_SYSTEM_CERT_POOL=true, confirm the system trust store is readable in the container"],"exampleFix":"# before\nexport LEGO_CA_CERTIFICATES=/etc/ssl/corp-ca.pem  # file missing/invalid\n# after\nopenssl x509 -in /etc/pki/corp/ca.pem -noout  # verify, then\nexport LEGO_CA_CERTIFICATES=/etc/pki/corp/ca.pem","handlingStrategy":"validation","validationCode":"if [ -n \"$LEGO_CA_CERTIFICATES\" ]; then\n  IFS=\":\" read -ra parts <<< \"$LEGO_CA_CERTIFICATES\"\n  for p in \"${parts[@]}\"; do openssl x509 -in \"$p\" -noout || exit 1; done\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate LEGO_CA_CERTIFICATES files with openssl before exporting the var","Use absolute paths and confirm CA mounts exist inside containers that run ACME"],"tags":["acme","tls","ca-certificates","go","panic","environment"],"backgroundTag":null,"analyzedSha":"5ac7c808815b0691009cd390414f03471312262f","analyzedAt":"2026-08-15T14:02:06.953Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}