{"record":{"id":"c5c50f714b5200dc","repo":"influxdata/influxdb","slug":"ca-certificate-pem-should-be-valid","errorCode":null,"errorMessage":"CA certificate PEM should be valid","messagePattern":"CA certificate PEM should be valid","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/client_util/src/connection.rs","lineNumber":187,"sourceCode":"            .connect_timeout(self.connect_timeout)\n            .timeout(self.timeout);\n        Ok(endpoint)\n    }\n\n    fn compose_middleware(self, channel: Channel, endpoint: Endpoint) -> Connection {\n        let headers_map: HeaderMap = self.headers.iter().cloned().collect();\n\n        // Compose channel with new tower middleware stack\n        let grpc_connection = tower::ServiceBuilder::new()\n            .layer(SetRequestHeadersLayer::new(self.headers))\n            .service(channel);\n\n        let mut http_builder = reqwest::Client::builder()\n            .connection_verbose(true)\n            .default_headers(headers_map);\n        if let Some(pem) = &self.ca_certificate_pem {\n            let cert =\n                reqwest::Certificate::from_pem(pem).expect(\"CA certificate PEM should be valid\");\n            http_builder = http_builder.add_root_certificate(cert);\n        }\n        let http_client = http_builder\n            .build()\n            .expect(\"reqwest::Client should have built\");\n\n        let http_connection = HttpConnection::new(endpoint.uri().clone(), http_client);\n\n        Connection::new(grpc_connection, http_connection)\n    }\n\n    /// Set the `User-Agent` header sent by this client.\n    pub fn user_agent(self, user_agent: impl Into<String>) -> Self {\n        Self {\n            user_agent: user_agent.into(),\n            ..self\n        }\n    }","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/influxdata/influxdb/blob/d28e26e048401c53cbb98cf2d6ab0cf1e98048ca/core/client_util/src/connection.rs#L169-L205","documentation":"ConnectionBuilder in core/client_util attaches a custom root CA for TLS by parsing the configured PEM with reqwest::Certificate::from_pem and .expect()ing success, so a malformed PEM panics the process instead of returning an error. from_pem requires PEM-encoded X.509 CERTIFICATE blocks; it rejects DER bytes, truncated files, wrong block types (e.g. a PRIVATE KEY block), or PEM surrounded by unrelated text.","triggerScenarios":"Setting ca_certificate_pem from a file that is not a valid PEM certificate: a DER-encoded cert, the TLS private key, an empty file, or certificate text mangled by copy/paste (missing BEGIN/END lines, embedded quotes or whitespace).","commonSituations":"Self-signed or private-CA deployments where the wrong secret is mounted; scripts that download a cert and capture an error page; passing the server key instead of the CA cert.","solutions":["Validate the file first: openssl x509 -in ca.pem -noout -text must succeed","If the cert is DER, convert it: openssl x509 -inform der -in ca.der -out ca.pem","Confirm the file contains only -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- sections and nothing else","Parse defensively in your own code: call reqwest::Certificate::from_pem(...)? yourself before building the connection and propagate the error"],"exampleFix":"// before: relies on the library's expect and panics\nlet conn = ConnectionBuilder::new(uri).ca_certificate_pem(pem_bytes).connect();\n\n// after: validate first, surface a real error\nlet cert = reqwest::Certificate::from_pem(&pem_bytes)\n    .context(\"CA certificate file is not valid PEM\")?;\nlet conn = ConnectionBuilder::new(uri).ca_certificate_pem(pem_bytes).connect();\n","handlingStrategy":"validation","validationCode":"// validate the PEM before handing it to the connection builder\nfn valid_pem(pem: &[u8]) -> bool {\n    reqwest::Certificate::from_pem(pem).is_ok()\n}\nif let Some(pem) = &config.ca_certificate_pem {\n    anyhow::ensure!(valid_pem(pem), \"ca_certificate_pem is not a valid PEM certificate\");\n}\n","typeGuard":null,"tryCatchPattern":"match reqwest::Certificate::from_pem(&pem_bytes) {\n    Ok(cert) => builder = builder.add_root_certificate(cert),\n    Err(e) => return Err(anyhow!(\"invalid CA PEM: {e}; run: openssl x509 -in ca.pem -noout -text\")),\n}\n","preventionTips":["Run openssl x509 -in ca.pem -noout -text as part of deployment checks","Never point ca_certificate_pem at a key file or DER blob; convert DER with openssl x509 -inform der","Fetch certs by pinned path from your secret store instead of ad-hoc curl/downloads","Watch process logs at startup - this path panics rather than returning an error"],"tags":["tls","pem","certificate","reqwest","panic","client"],"backgroundTag":"invalid-ca-certificate-pem","analyzedSha":"d28e26e048401c53cbb98cf2d6ab0cf1e98048ca","analyzedAt":"2026-08-16T19:53:34.623Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}