{"record":{"id":"d970c717dcc926c2","repo":"cloudflare/cloudflared","slug":"error-loading-the-certificate-pool","errorCode":null,"errorMessage":"error loading the certificate pool","messagePattern":"error loading the certificate pool","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tlsconfig/origin_ca.go","lineNumber":33,"sourceCode":"const (\n\tOriginCAPoolFlag = \"origin-ca-pool\"\n)\n\nfunc LoadOriginCA(originCAPoolFilename string, log *zerolog.Logger) (*x509.CertPool, error) {\n\tvar originCustomCAPool []byte\n\n\tif originCAPoolFilename != \"\" {\n\t\tvar err error\n\t\t// nolint:gosec\n\t\toriginCustomCAPool, err = os.ReadFile(originCAPoolFilename)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, fmt.Sprintf(\"unable to read the file %s for --%s\", originCAPoolFilename, OriginCAPoolFlag))\n\t\t}\n\t}\n\n\toriginCertPool, err := loadOriginCertPool(originCustomCAPool, log)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"error loading the certificate pool\")\n\t}\n\n\t// Windows users should be notified that they can use the flag\n\tif runtime.GOOS == \"windows\" && originCAPoolFilename == \"\" {\n\t\tlog.Info().Msgf(\"cloudflared does not support loading the system root certificate pool on Windows. Please use --%s <PATH> to specify the path to the certificate pool\", OriginCAPoolFlag)\n\t}\n\n\treturn originCertPool, nil\n}\n\nfunc LoadCustomOriginCA(originCAFilename string) (*x509.CertPool, error) {\n\t// First, obtain the system certificate pool\n\tcertPool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\tcertPool = x509.NewCertPool()\n\t}\n\n\t// Next, append the Cloudflare CAs into the system pool","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/tlsconfig/origin_ca.go#L15-L51","documentation":"After optionally reading the custom CA file, LoadOriginCA builds the certificate pool via loadOriginCertPool. This error means that internal call failed — e.g. the custom pool bytes contain no valid certificates or an internal step errored.","triggerScenarios":"loadOriginCertPool returns an error because the custom CA bytes cannot be parsed into an x509 pool or the Cloudflare root CA load inside it fails.","commonSituations":"Passing a file that is not a PEM certificate (e.g. a private key or config file) to --origin-ca-pool; empty file; corrupted or expired certificates.","solutions":["Verify the file contains valid PEM certificates (openssl x509 -in <file> -text -noout)","Regenerate or re-export the origin CA pool in PEM format","Check the wrapped error for the underlying cause (parse vs. root-CA failure)","Update cloudflared if the Cloudflare root bundle fails to load"],"exampleFix":"// before\n--origin-ca-pool /path/to/key.pem   # not a certificate\n// after\nopenssl x509 -in /path/to/ca.pem -text -noout  # validate first\ncloudflared ... --origin-ca-pool /path/to/ca.pem","handlingStrategy":"validation","validationCode":"// verify the CA file parses as PEM before passing it in\npemBytes, err := os.ReadFile(path)\nif err != nil {\n    return err\n}\nblock, _ := pem.Decode(pemBytes)\nif block == nil || block.Type != \"CERTIFICATE\" {\n    return fmt.Errorf(\"%s does not contain a PEM certificate\", path)\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    return fmt.Errorf(\"invalid certificate in %s: %w\", path, err)\n}","typeGuard":null,"tryCatchPattern":"pool, err := tlsconfig.LoadOriginCA(path, log)\nif err != nil && strings.Contains(err.Error(), \"error loading the certificate pool\") {\n    return fmt.Errorf(\"CA pool at %q is not a valid certificate bundle: %w\", path, err)\n}","preventionTips":["Only pass PEM certificate bundles (not keys) to --origin-ca-pool","Validate files with `openssl x509 -in <file> -text -noout` first","Keep the file non-empty and free of editor artifacts"],"tags":["tls","certificates","configuration"],"backgroundTag":"schema-validation-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}