{"record":{"id":"d5a8a3daf1c80ab8","repo":"t8y2/dbx","slug":"read-neo4j-ca-certificate-w","errorCode":null,"errorMessage":"read Neo4j CA certificate: %w","messagePattern":"read Neo4j CA certificate: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/neo4j-go/driver.go","lineNumber":75,"sourceCode":"\t\tdriverConfig.MaxConnectionLifetime = time.Hour\n\t\tdriverConfig.TelemetryDisabled = true\n\t}}\n\ttlsConfigurer, err := neo4jTLSConfigurer(params)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif tlsConfigurer != nil {\n\t\tconfigurers = append(configurers, tlsConfigurer)\n\t}\n\treturn neo4j.NewDriver(uri, authToken, configurers...)\n}\n\nfunc neo4jTLSConfigurer(params connectParams) (func(*config.Config), error) {\n\tvar tlsConfig *tls.Config\n\tif params.CACertPath != \"\" {\n\t\tcertificate, err := os.ReadFile(params.CACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Neo4j CA certificate: %w\", err)\n\t\t}\n\t\troots, err := x509.SystemCertPool()\n\t\tif err != nil || roots == nil {\n\t\t\troots = x509.NewCertPool()\n\t\t}\n\t\tif !roots.AppendCertsFromPEM(certificate) {\n\t\t\treturn nil, errors.New(\"Neo4j CA certificate contains no valid PEM certificate\")\n\t\t}\n\t\ttlsConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: roots}\n\t}\n\tvar clientCertificateProvider neo4jauth.ClientCertificateProvider\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"both client certificate and client key are required\")\n\t\t}\n\t\tprovider, err := neo4jauth.NewStaticClientCertificateProvider(neo4jauth.ClientCertificate{\n\t\t\tCertFile: params.ClientCertPath,\n\t\t\tKeyFile:  params.ClientKeyPath,","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/neo4j-go/driver.go#L57-L93","documentation":"neo4jTLSConfigurer (called from openDriver) reads the CA certificate file at params.CACertPath to build the TLS trust pool. If os.ReadFile fails — missing file, wrong path, or permission denied — the driver wraps the OS error as 'read Neo4j CA certificate: ...'.","triggerScenarios":"Connecting with a ca_cert_path/connectParams.CACertPath pointing to a file that does not exist, is unreadable by the process user, is a directory, or whose mount is unavailable.","commonSituations":"Relative path resolved from a different working directory than expected; container image missing the mounted cert; secrets file not yet injected at startup; wrong file permissions after k8s secret mount; typo'd path in the connection config.","solutions":["Verify the path exists and is readable: os.Stat / ls -l the ca_cert_path value","Use an absolute path instead of a relative one, or set the correct working directory","Fix file permissions so the driver process user can read the cert","In containers, ensure the cert is mounted/injected before the driver starts","Clear CACertPath if TLS with a custom CA is not actually needed (falls back to system roots)"],"exampleFix":"// before\nparams.CACertPath = \"certs/neo4j-ca.pem\" // relative, wrong cwd\n// after\nif _, err := os.Stat(\"/etc/neo4j/certs/neo4j-ca.pem\"); err != nil {\n    log.Fatal(err)\n}\nparams.CACertPath = \"/etc/neo4j/certs/neo4j-ca.pem\"","handlingStrategy":"validation","validationCode":"// Go: validate the CA cert path before connecting\nfunc validateCACert(path string) error {\n    if path == \"\" {\n        return nil\n    }\n    info, err := os.Stat(path)\n    if err != nil {\n        return fmt.Errorf(\"CA cert %s: %w\", path, err)\n    }\n    if info.IsDir() {\n        return fmt.Errorf(\"CA cert %s is a directory\", path)\n    }\n    f, err := os.Open(path)\n    if err != nil {\n        return fmt.Errorf(\"CA cert %s unreadable: %w\", path, err)\n    }\n    return f.Close()\n}","typeGuard":null,"tryCatchPattern":"cfg, err := neo4jTLSConfigurer(params)\nif err != nil {\n    if strings.Contains(err.Error(), \"read Neo4j CA certificate\") {\n        return nil, fmt.Errorf(\"fix ca_cert_path %q: %w\", params.CACertPath, err)\n    }\n    return nil, err\n}","preventionTips":["Use absolute cert paths resolved at startup","Check cert existence/readability in readiness checks before connecting","In containers, mount certs as read-only volumes and verify after secret injection","Set explicit file permissions for the driver's service user"],"tags":["neo4j","tls","certificate","filesystem","go"],"backgroundTag":"ca-certificate-not-found","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}