{"record":{"id":"bacbe5943799bac3","repo":"zeroclaw-labs/zeroclaw","slug":"mcp-server-tls-ca-certificate-at-path-ex","errorCode":null,"errorMessage":"MCP server `{}`: TLS CA certificate at `{path}` exceeds the {MAX_TLS_CA_BYTES}-byte limit","messagePattern":"MCP server `(.+?)`: TLS CA certificate at `(.+?)` exceeds the (.+?)-byte limit","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/mcp_transport.rs","lineNumber":143,"sourceCode":"        format!(\n            \"MCP server `{}`: cannot read TLS CA certificate at `{path}`\",\n            config.name\n        )\n    })?;\n    let opened_metadata = file.metadata().with_context(|| {\n        format!(\n            \"MCP server `{}`: cannot inspect opened TLS CA certificate at `{path}`\",\n            config.name\n        )\n    })?;\n    if !opened_metadata.file_type().is_file() {\n        bail!(\n            \"MCP server `{}`: TLS CA certificate path must name a regular file: `{path}`\",\n            config.name\n        );\n    }\n    if opened_metadata.len() > MAX_TLS_CA_BYTES as u64 {\n        bail!(\n            \"MCP server `{}`: TLS CA certificate at `{path}` exceeds the {MAX_TLS_CA_BYTES}-byte limit\",\n            config.name\n        );\n    }\n\n    let mut pem = Vec::with_capacity(opened_metadata.len() as usize + 1);\n    file.take(MAX_TLS_CA_BYTES as u64 + 1)\n        .read_to_end(&mut pem)\n        .with_context(|| {\n            format!(\n                \"MCP server `{}`: cannot read TLS CA certificate at `{path}`\",\n                config.name\n            )\n        })?;\n    if pem.len() > MAX_TLS_CA_BYTES {\n        bail!(\n            \"MCP server `{}`: TLS CA certificate at `{path}` exceeds the {MAX_TLS_CA_BYTES}-byte limit\",\n            config.name","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/mcp_transport.rs#L125-L161","documentation":"Size guard in load_tls_ca_pem, which reads a custom CA certificate for an MCP server's remote HTTP transport (called when building the remote HTTP client). It fires when the file at the configured CA path is a regular file but its byte length exceeds MAX_TLS_CA_BYTES. An oversized 'certificate' almost always means the path points to the wrong file (a bundle dump, keychain export, or binary) rather than a valid PEM CA certificate. Point the config at a single PEM-encoded CA certificate within the size limit.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:143 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a smaller CA certificate bundle within the byte limit."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","contentChangedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}