{"record":{"id":"b8f196a8ff85726b","repo":"yudai/gotty","slug":"could-not-parse-ca-crt-file-data-in-s","errorCode":null,"errorMessage":"could not parse CA crt file data in %s","messagePattern":"could not parse CA crt file data in (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/server.go","lineNumber":239,"sourceCode":"\t\ttlsConfig, err := server.tlsConfig()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"failed to setup TLS configuration\")\n\t\t}\n\t\tsrv.TLSConfig = tlsConfig\n\t}\n\n\treturn srv, nil\n}\n\nfunc (server *Server) tlsConfig() (*tls.Config, error) {\n\tcaFile := homedir.Expand(server.options.TLSCACrtFile)\n\tcaCert, err := ioutil.ReadFile(caFile)\n\tif err != nil {\n\t\treturn nil, errors.New(\"could not open CA crt file \" + caFile)\n\t}\n\tcaCertPool := x509.NewCertPool()\n\tif !caCertPool.AppendCertsFromPEM(caCert) {\n\t\treturn nil, errors.New(\"could not parse CA crt file data in \" + caFile)\n\t}\n\ttlsConfig := &tls.Config{\n\t\tClientCAs:  caCertPool,\n\t\tClientAuth: tls.RequireAndVerifyClientCert,\n\t}\n\treturn tlsConfig, nil\n}\n","sourceCodeStart":221,"sourceCodeEnd":247,"githubUrl":"https://github.com/yudai/gotty/blob/a080c85cbc59226c94c6941ad8c395232d72d517/server/server.go#L221-L247","documentation":"After successfully reading the CA file, tlsConfig() feeds the bytes to x509.AppendCertsFromPEM. If no certificate could be parsed from the data, this error is returned with the file path. The file exists but its contents are not a valid PEM-encoded certificate.","triggerScenarios":"TLSCACrtFile contains a private key, a DER (binary) certificate, concatenated garbage, an empty file, or text PEM without CERTIFICATE blocks.","commonSituations":"Pointing at the server key instead of the CA cert; copying a cert through a transfer that mangled it; an empty placeholder file created by a deployment script.","solutions":["Verify the file is PEM: it should start with -----BEGIN CERTIFICATE-----","Convert DER to PEM if needed: openssl x509 -inform DER -in ca.der -out ca.crt","Re-download/re-copy the CA certificate and check with openssl x509 -in ca.crt -noout -text","Ensure you are not pointing at the private key or a chain of unrelated certs"],"exampleFix":"// before\ntls_ca_crt_file = \"/etc/ssl/private/ca.key\"\n// after\ntls_ca_crt_file = \"/etc/gotty/pki/ca.crt\"","handlingStrategy":"validation","validationCode":"pemBytes, _ := os.ReadFile(caPath)\nif block, _ := pem.Decode(pemBytes); block == nil || block.Type != \"CERTIFICATE\" {\n    log.Fatalf(\"%s is not a PEM certificate\", caPath)\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    log.Fatalf(\"CA cert unparseable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := srv.Run(ctx); err != nil {\n    if strings.Contains(err.Error(), \"could not parse CA crt file data\") {\n        log.Fatalf(\"Bad CA PEM data: %v\", err)\n    }\n}","preventionTips":["Validate PEM content of CA files at deploy time (openssl x509 -noout)","Never point tls_ca_crt_file at a private key or DER binary","Re-verify certs after any copy/transfer step"],"tags":["tls","certificates","pem"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"a080c85cbc59226c94c6941ad8c395232d72d517","analyzedAt":"2026-09-02T16:42:38.150Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}