{"record":{"id":"d7ed2c953ab7ece0","repo":"amir20/dozzle","slug":"failed-to-read-certificates-w","errorCode":null,"errorMessage":"failed to read certificates: %w","messagePattern":"failed to read certificates: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/support/cli/agent_command.go","lineNumber":151,"sourceCode":"\tif h.onCloudSet != nil {\n\t\th.onCloudSet()\n\t}\n\tif err := os.Remove(\"./data/cloud.yml\"); err != nil && !os.IsNotExist(err) {\n\t\tlog.Error().Err(err).Msg(\"Could not remove cloud.yml on agent\")\n\t}\n}\n\nfunc (a *AgentCmd) Run(args Args, embeddedCerts embed.FS) error {\n\tif args.Mode != \"server\" {\n\t\treturn fmt.Errorf(\"agent command is only available in server mode\")\n\t}\n\tclient, err := docker.NewLocalClient(args.Hostname)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create docker client: %w\", err)\n\t}\n\tcerts, err := ReadCertificates(embeddedCerts, args.CertPath, args.KeyPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read certificates: %w\", err)\n\t}\n\n\tlistener, err := net.Listen(\"tcp\", args.Agent.Addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to listen: %w\", err)\n\t}\n\tconst agentAddrFile = \"/tmp/dozzle-agent.addr\"\n\tif err := os.WriteFile(agentAddrFile, []byte(args.Agent.Addr), 0644); err != nil {\n\t\treturn fmt.Errorf(\"failed to write agent address file: %w\", err)\n\t}\n\tgo StartEvent(args, \"\", client, \"agent\")\n\n\tctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)\n\tdefer stop()\n\n\t// Create shared client service (single ContainerStore for both agent server and notifications)\n\tclientService := docker_support.NewDockerClientService(client, args.Filter)\n","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/amir20/dozzle/blob/d9463cbe21874e44ab79db6fa63e746ca7d22928/internal/support/cli/agent_command.go#L133-L169","documentation":"Returned by AgentCmd.Run when ReadCertificates fails to load the embedded or on-disk TLS certificate/key pair the gRPC agent requires. Agents and main servers authenticate each other with these shared certs, so startup aborts without them.","triggerScenarios":"Custom --cert-path/--key-path files are missing, unreadable, or malformed PEM; key does not match certificate; certificates were not regenerated after a version upgrade (make generate).","commonSituations":"User overrides cert paths with files from an old install; cert/key mismatch after regenerating only one; file permissions block reading the PEM files; running a custom build without running `make generate`.","solutions":["Remove custom --cert-path/--key-path flags so the embedded certs are used.","If custom certs are required, verify both files exist, are valid PEM, and match as a pair.","Regenerate the shared certs: `make generate`.","Check file permissions on the cert and key files.","Ensure the agent and main server share the same certificate pair."],"exampleFix":"// before\ncustomCert=/etc/dozzle/old-cert.pem\n--cert-path $customCert --key-path /etc/dozzle/old-key.pem\n// after\nrm -f /etc/dozzle/old-*.pem\nmake generate  # or drop the custom cert flags entirely","handlingStrategy":"validation","validationCode":"for f in \"$CERT\" \"$KEY\"; do [ -r \"$f\" ] && openssl \"$([ \"${f##*.}\" = key ] && echo rsa || echo x509)\" -in \"$f\" -noout >/dev/null || { echo \"bad cert file: $f\"; exit 1; }; done","typeGuard":null,"tryCatchPattern":"if err := agentCmd.Run(args, embeddedCerts); err != nil {\n  if strings.Contains(err.Error(), \"failed to read certificates\") {\n    log.Fatal().Err(err).Msg(\"check --cert-path/--key-path files\")\n  }\n}","preventionTips":["Regenerate and deploy cert/key pairs together with `make generate`","Validate PEM files with openssl before use","Prefer embedded certs over custom paths when possible","Verify file readability for the process user"],"tags":["tls","certificates","agent"],"backgroundTag":"file-read-failed","analyzedSha":"d9463cbe21874e44ab79db6fa63e746ca7d22928","analyzedAt":"2026-09-07T10:08:55.855Z","contentChangedAt":"2026-09-07T10:08:55.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}