{"record":{"id":"b9a4ed732a7b1264","repo":"hyperledger/fabric","slug":"reading-orderer-ca-certificate-s","errorCode":null,"errorMessage":"reading orderer CA certificate: %s","messagePattern":"reading orderer CA certificate: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/osnadmin/main.go","lineNumber":93,"sourceCode":"\t\treturn \"\", 1, err\n\t}\n\n\t//\n\t// flag validation\n\t//\n\tvar (\n\t\tosnURL        string\n\t\tcaCertPool    *x509.CertPool\n\t\ttlsClientCert tls.Certificate\n\t)\n\t// TLS enabled\n\tif *caFile != \"\" {\n\t\tosnURL = fmt.Sprintf(\"https://%s\", *orderer)\n\t\tvar err error\n\t\tcaCertPool = x509.NewCertPool()\n\t\tcaFilePEM, err := os.ReadFile(*caFile)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, fmt.Errorf(\"reading orderer CA certificate: %s\", err)\n\t\t}\n\t\tif !caCertPool.AppendCertsFromPEM(caFilePEM) {\n\t\t\treturn \"\", 1, errors.New(\"failed to add ca-file PEM to cert pool\")\n\t\t}\n\n\t\ttlsClientCert, err = tls.LoadX509KeyPair(*clientCert, *clientKey)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, fmt.Errorf(\"loading client cert/key pair: %s\", err)\n\t\t}\n\t} else { // TLS disabled\n\t\tosnURL = fmt.Sprintf(\"http://%s\", *orderer)\n\t}\n\n\tvar marshaledConfigBlock []byte\n\tif *configBlockPath != \"\" {\n\t\tmarshaledConfigBlock, err = os.ReadFile(*configBlockPath)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, fmt.Errorf(\"reading config block: %s\", err)","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/cmd/osnadmin/main.go#L75-L111","documentation":"osnadmin (ordering node admin) loads the orderer's TLS CA certificate from --ca-file when establishing an HTTPS connection. If os.ReadFile on that PEM file fails, this error wraps the OS error and the command exits with status 1 before any request is sent. It is a file-access problem with the supplied CA certificate path.","triggerScenarios":"Running osnadmin channel join/list/remove with --ca-file pointing to a path that does not exist, is unreadable, or is a directory.","commonSituations":"Wrong path after moving TLS certs; secrets not mounted in a k8s pod; permission denied for the running user; typo'd path relative to cwd.","solutions":["Verify the CA file exists and is readable: ls -l <ca-file> or cat it.","Use an absolute path for --ca-file rather than a relative one.","In containers/k8s, confirm the secret/volume mounting the CA cert is present and mounted at the expected path.","Fix file permissions (chmod 644 on the CA cert is typical)."],"exampleFix":"// before\nosnadmin channel list --orderer-address orderer:7053 --ca-file ./certs/ca.pem\n// after\nosnadmin channel list --orderer-address orderer:7053 --ca-file /etc/fabric/tls/ca.crt","handlingStrategy":"validation","validationCode":"caFile := \"/etc/fabric/tls/ca.crt\"\nif info, err := os.Stat(caFile); err != nil {\n    log.Fatalf(\"ca-file missing: %v\", err)\n} else if info.IsDir() {\n    log.Fatal(\"ca-file must be a file, not a directory\")\n}\nif _, err := os.ReadFile(caFile); err != nil {\n    log.Fatalf(\"ca-file unreadable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths for --ca-file","Mount TLS secrets into containers before running osnadmin","Verify cert presence with ls/test in CI scripts","Keep CA certs world-readable (0644)"],"tags":["tls","osnadmin","file-not-found"],"backgroundTag":"ca-cert-file-missing","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}