{"record":{"id":"d6a8bf62a8a958cc","repo":"risingwavelabs/risingwave","slug":"could-not-load-platform-certs","errorCode":null,"errorMessage":"could not load platform certs","messagePattern":"could not load platform certs","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/connector/src/connector_common/mqtt_common.rs","lineNumber":171,"sourceCode":"            .as_ref()\n            .map(|qos| match qos {\n                QualityOfService::AtMostOnce => QoS::AtMostOnce,\n                QualityOfService::AtLeastOnce => QoS::AtLeastOnce,\n                QualityOfService::ExactlyOnce => QoS::ExactlyOnce,\n            })\n            .unwrap_or(QoS::AtMostOnce)\n    }\n\n    fn get_tls_config(&self) -> ConnectorResult<rustls::ClientConfig> {\n        let mut root_cert_store = rustls::RootCertStore::empty();\n        if let Some(ca) = &self.ca {\n            let certificates = load_certs(ca)?;\n            for cert in certificates {\n                root_cert_store.add(cert).unwrap();\n            }\n        } else {\n            for cert in\n                rustls_native_certs::load_native_certs().expect(\"could not load platform certs\")\n            {\n                root_cert_store.add(cert).unwrap();\n            }\n        }\n\n        let builder = rustls::ClientConfig::builder().with_root_certificates(root_cert_store);\n\n        let tls_config = if let (Some(client_cert), Some(client_key)) =\n            (self.client_cert.as_ref(), self.client_key.as_ref())\n        {\n            let certs = load_certs(client_cert)?;\n            let key = load_private_key(client_key)?;\n\n            builder.with_client_auth_cert(certs, key)?\n        } else {\n            builder.with_no_client_auth()\n        };\n","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/mqtt_common.rs#L153-L189","documentation":"When building the MQTT TLS client without an explicit CA certificate, get_tls_config loads the operating system's native root certificates via rustls_native_certs::load_native_certs() and panics (expect) if that fails. This means the platform certificate store could not be read, so TLS trust anchors would be unavailable.","triggerScenarios":"build_client with TLS enabled and no `ca` file configured, on systems where the native cert store is missing/unreadable: no /etc/ssl/certs or equivalent, empty SSL_CERT_FILE/SSL_CERT_DIR pointing at bad locations, stripped-down container images without ca-certificates.","commonSituations":"Running in minimal Docker/scratch images lacking the ca-certificates package; SSL_CERT_FILE env var set to a nonexistent path; Windows/macOS cert store access failures; Alpine images without the ca-certificates-bundle.","solutions":["Configure an explicit CA certificate file for the MQTT source (the `ca` option) so native cert loading is skipped.","Install OS CA certificates in the container/host (e.g. `apt-get install ca-certificates` or `apk add ca-certificates`).","Check and unset/fix SSL_CERT_FILE and SSL_CERT_DIR environment variables if they point to invalid paths.","Reproduce rustls_native_certs::load_native_certs() standalone to see the exact underlying error."],"exampleFix":"// before: TLS enabled, no CA configured on a slim image\n// after: provide explicit CA file\nCREATE SOURCE ... WITH (\n  connector = 'mqtt',\n  tls.mode = 'enable',\n  ca = '/etc/ssl/certs/ca-certificates.crt'\n);","handlingStrategy":"fallback","validationCode":"// ensure platform certs exist before relying on native store\nlet has_native = std::path::Path::new(\"/etc/ssl/certs/ca-certificates.crt\").exists()\n    || std::env::var_os(\"SSL_CERT_FILE\").map(|p| std::path::Path::new(&p).exists()).unwrap_or(false);\nif !has_native {\n    return Err(\"no platform certs; configure the connector 'ca' option\");\n}","typeGuard":null,"tryCatchPattern":"// avoid the expect by falling back to a bundled/explicit CA\nmatch rustls_native_certs::load_native_certs() {\n    Ok(certs) if !certs.is_empty() => certs,\n    _ => load_certs(std::path::Path::new(\"/etc/ssl/certs/ca-certificates.crt\"))\n        .expect(\"no native or fallback CA available\"),\n}","preventionTips":["Always configure an explicit CA file for MQTT TLS in containers","Install ca-certificates in minimal images (scratch/alpine/distroless)","Audit SSL_CERT_FILE / SSL_CERT_DIR env vars in deployment manifests","Smoke-test TLS connectivity at startup rather than at first message"],"tags":["mqtt","tls","certificates","panic"],"backgroundTag":"missing-dependency","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}