{"record":{"id":"ca03fc7f7ca6b841","repo":"gofr-dev/gofr","slug":"invalid-certificate-file","errorCode":null,"errorMessage":"invalid certificate file","messagePattern":"invalid certificate file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/gofr/http_server.go","lineNumber":32,"sourceCode":"\tgofrHTTP \"gofr.dev/pkg/gofr/http\"\n\t\"gofr.dev/pkg/gofr/http/middleware\"\n\t\"gofr.dev/pkg/gofr/logging\"\n\t\"gofr.dev/pkg/gofr/websocket\"\n)\n\ntype httpServer struct {\n\trouter      *gofrHTTP.Router\n\tport        int\n\tws          *websocket.Manager\n\tsrvMu       sync.Mutex // guards srv, which run() writes on the serve goroutine and Shutdown() reads on the caller goroutine\n\tsrv         *http.Server\n\tcertFile    string\n\tkeyFile     string\n\tstaticFiles map[string]string\n}\n\nvar (\n\terrInvalidCertificateFile = errors.New(\"invalid certificate file\")\n\terrInvalidKeyFile         = errors.New(\"invalid key file\")\n)\n\n// logRouterChoice reports the route matcher the router resolved to.\n//\n// It stays quiet for the default, which every service gets and nobody needs told\n// about. It speaks up for the two cases that are worth a line: the opt-in matcher\n// being active, and a GOFR_ROUTER value that was not understood — the latter\n// falls back to mux, which looks exactly like never having set the variable, so a\n// typo would otherwise cost the opt-in with nothing said.\nfunc logRouterChoice(logger logging.Logger, r *gofrHTTP.Router) {\n\trequested := os.Getenv(gofrHTTP.RouterEnvVar)\n\tif requested == \"\" {\n\t\treturn\n\t}\n\n\tif !strings.EqualFold(requested, r.Matcher()) {\n\t\tlogger.Warnf(\"unrecognized %s value %q, using the %q router; valid values are %q and %q\",","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http_server.go#L14-L50","documentation":"errInvalidCertificateFile is declared in pkg/gofr/http_server.go and returned by validateCertificateAndKeyFiles when the configured TLS certificate file does not exist (os.Stat reports IsNotExist). gofr checks cert/key files at startup before enabling HTTPS and aborts with this error rather than failing later during TLS handshake.","triggerScenarios":"Starting a gofr HTTP server with HTTPS_CERT_FILE (or equivalent config) pointing to a certificate path that does not exist on disk; validateCertificateAndKeyFiles stats the cert file and os.IsNotExist(err) is true.","commonSituations":"Typo in the cert path; mounting certificates at a different location in Docker/K8s than the configured path; secret not mounted before the service starts; relative path resolved from a different working directory.","solutions":["Verify the certificate path exists: ls the exact configured path from the service's working directory","Fix the env/config value (HTTPS_CERT_FILE or gofr config) to the correct absolute path","In containers, confirm the cert secret/volume is mounted before startup","If using self-signed/dev certs, generate them first (e.g. openssl req -x509 ...) at the configured location"],"exampleFix":"// before\nexport HTTPS_CERT_FILE=./certs/server.crt   # file not present\n// after\nexport HTTPS_CERT_FILE=/etc/ssl/gofr/server.crt  # verified existing path\nls -l /etc/ssl/gofr/server.crt","handlingStrategy":"validation","validationCode":"func checkCert(path string) error {\n    if path == \"\" {\n        return errors.New(\"certificate path not configured\")\n    }\n    if _, err := os.Stat(path); err != nil {\n        return fmt.Errorf(\"certificate file missing: %w\", err)\n    }\n    return nil\n}","typeGuard":"func isInvalidCertificate(err error) bool {\n    return errors.Is(err, errInvalidCertificateFile)\n}","tryCatchPattern":"if err := server.Run(); err != nil {\n    if errors.Is(err, errInvalidCertificateFile) {\n        log.Fatalf(\"TLS cert missing: %v\", err)\n    }\n    return err\n}","preventionTips":["Use absolute paths for cert files in config","Run os.Stat on cert paths in a pre-start health check","Ensure K8s/Docker secret mounts complete before process start","Provision dev certs in setup scripts so local runs never miss them"],"tags":["tls","certificate","startup","configuration"],"backgroundTag":"tls-certificate-file-missing","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}