{"record":{"id":"d853473e008212d7","repo":"juicedata/juicefs","slug":"error-appending-ca-cert-to-pool","errorCode":null,"errorMessage":"error appending CA cert to pool","messagePattern":"error appending CA cert to pool","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/format.go","lineNumber":271,"sourceCode":"\t\t\tformat.Bucket = u.String()\n\t\t}\n\n\t\t// Configure client TLS when params are provided\n\t\tif values.Get(\"ca-certs\") != \"\" && values.Get(\"ssl-cert\") != \"\" && values.Get(\"ssl-key\") != \"\" {\n\n\t\t\tclientTLSCert, err := tls.LoadX509KeyPair(values.Get(\"ssl-cert\"), values.Get(\"ssl-key\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading certificate and key file: %s\", err.Error())\n\t\t\t}\n\n\t\t\tcertPool := x509.NewCertPool()\n\t\t\tcaCertPEM, err := os.ReadFile(values.Get(\"ca-certs\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading CA cert file: %s\", err.Error())\n\t\t\t}\n\n\t\t\tif certAdded := certPool.AppendCertsFromPEM(caCertPEM); !certAdded {\n\t\t\t\treturn nil, fmt.Errorf(\"error appending CA cert to pool\")\n\t\t\t}\n\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.RootCAs = certPool\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.Certificates = []tls.Certificate{clientTLSCert}\n\t\t}\n\t}\n\n\tif format.Shards > 1 {\n\t\tblob, err = object.NewSharded(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken, format.Shards)\n\t} else {\n\t\tblob, err = object.CreateStorage(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken)\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tblob = object.WithPrefix(blob, format.Name+\"/\")\n\tinitStorageTiers(blob, format.Tiers)\n\tif format.EncryptKey != \"\" {","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L253-L289","documentation":"This error is thrown when a user-supplied CA certificate PEM file is read successfully but none of its certificates could be parsed and added to the TLS root CA pool. AppendCertsFromPEM returns false when the file contains no valid PEM certificate blocks, so the TLS transport would have no trusted roots from this file.","triggerScenarios":"Running `juicefs format` (or config/destroy/fsck/gc) with `--ca-certs` pointing to a file whose contents are not parseable PEM certificates — e.g. a public key, a private key, concatenated garbage, an empty file, or DER-encoded (binary) certificates.","commonSituations":"Passing a client private key file instead of a CA bundle; exporting certificates in DER format instead of PEM; a truncated or corrupted ca-certificates bundle; passing an intermediate chain without any CA certs.","solutions":["Verify the file contains PEM blocks starting with '-----BEGIN CERTIFICATE-----' (e.g. `grep -c 'BEGIN CERTIFICATE' ca.pem`)","Convert DER certificates to PEM: `openssl x509 -inform der -in cert.der -out cert.pem`","Use a known-good CA bundle (e.g. /etc/ssl/certs/ca-certificates.crt) to confirm the flag wiring works","Concatenate only certificate entries: `openssl crl2pkcs7 -nocrl -certfile chain.pem | openssl pkcs7 -print_certs` to inspect what the file holds"],"exampleFix":"// before (file is DER or a key, not PEM certs)\n--ca-certs client.key\n// after\nopenssl x509 -inform der -in cert.der -out ca.pem\njuicefs format --ca-certs ca.pem ...","handlingStrategy":"validation","validationCode":"pem, err := os.ReadFile(caCertFile)\nif err != nil { return err }\nif !bytes.Contains(pem, []byte(\"-----BEGIN CERTIFICATE-----\")) {\n    return fmt.Errorf(\"%s contains no PEM certificates\", caCertFile)\n}","typeGuard":"func isPEMCertBundle(data []byte) bool {\n    block, rest := pem.Decode(data)\n    for block != nil {\n        if block.Type == \"CERTIFICATE\" { return true }\n        block, rest = pem.Decode(rest)\n    }\n    return false\n}","tryCatchPattern":"if _, err := createStorage(...); err != nil {\n    if strings.Contains(err.Error(), \"error appending CA cert to pool\") {\n        // inspect the CA file: not parseable PEM certificates\n    }\n}","preventionTips":["Keep CA bundles in PEM format; convert any DER certs before use","Sanity-check with `openssl x509 -in ca.pem -noout` before passing the file","Never pass private keys or CSRs via --ca-certs"],"tags":["tls","certificates","object-storage"],"backgroundTag":"invalid-argument-value","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}