{"record":{"id":"be80ae9feac10ba9","repo":"dgraph-io/dgraph","slug":"could-not-read-parent-cert","errorCode":null,"errorMessage":"could not read parent cert","messagePattern":"could not read parent cert","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/info.go","lineNumber":85,"sourceCode":"\n\t\tdefault:\n\t\t\tinfo.err = errors.Errorf(\"Unsupported certificate\")\n\t\t\treturn &info\n\t\t}\n\n\t\tswitch key := cert.PublicKey.(type) {\n\t\tcase *rsa.PublicKey:\n\t\t\tinfo.digest = getHexDigest(key.N.Bytes())\n\t\tcase *ecdsa.PublicKey:\n\t\t\tinfo.digest = getHexDigest(elliptic.Marshal(key.Curve, key.X, key.Y))\n\t\tdefault:\n\t\t\tinfo.digest = \"Invalid public key\"\n\t\t}\n\n\t\tif file != defaultCACert {\n\t\t\tparent, err := readCert(defaultCACert)\n\t\t\tif err != nil {\n\t\t\t\tinfo.err = errors.Wrapf(err, \"could not read parent cert\")\n\t\t\t\treturn &info\n\t\t\t}\n\t\t\tinfo.verifiedCA = \"FAILED\"\n\t\t\tif err := cert.CheckSignatureFrom(parent); err == nil {\n\t\t\t\tinfo.verifiedCA = \"PASSED\"\n\t\t\t}\n\t\t}\n\n\tcase strings.HasSuffix(file, \".key\"):\n\t\tswitch {\n\t\tcase file == defaultCAKey:\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Root CA key\"\n\n\t\tcase file == defaultNodeKey:\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Node key\"\n\n\t\tcase strings.HasPrefix(file, \"client.\"):\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Client key\"","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/info.go#L67-L103","documentation":"For any non-CA certificate, getFileInfo tries to verify it against the default CA cert (ca.crt) via readCert(defaultCACert). If the parent CA certificate cannot be read/parsed, the per-file info records 'could not read parent cert' wrapping the underlying error, and CA verification is skipped.","triggerScenarios":"Running `dgraph cert info` when ca.crt is missing, unreadable (permissions), empty, or corrupt in the TLS directory while node/client certs exist.","commonSituations":"CA cert deleted during cleanup, directory copied without ca.crt, partial `dgraph cert` runs, or a corrupted/truncated ca.crt after a disk issue.","solutions":["Ensure ca.crt exists in the TLS directory (regenerate with `dgraph cert create --ca` if needed)","Check file permissions so the running user can read ca.crt","Verify ca.crt parses (openssl x509 -in tls/ca.crt -noout) and re-create it if corrupt"],"exampleFix":"// before\ntls/: node.crt, node.key (ca.crt deleted)\ndgraph cert info  # could not read parent cert\n// after\ndgraph cert create --ca  # regenerate CA, then rerun dgraph cert info","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(filepath.Join(tlsDir, \"ca.crt\")); err != nil {\n    return fmt.Errorf(\"ca.crt missing in %s: regenerate with `dgraph cert create --ca`\", tlsDir)\n}\n// optionally verify it parses: openssl x509 -in tls/ca.crt -noout","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run `dgraph cert create` at least once for the CA before node/client certs","Check file permissions so the dgraph user can read ca.crt","Verify ca.crt parses with openssl before running cert info"],"tags":["tls","x509","file-io","chain-of-trust"],"backgroundTag":"certificate-not-found","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}