{"record":{"id":"dd182e42b9533ead","repo":"cloudflare/cloudflared","slug":"could-not-append-cloudflare-root-cas-to-cloudflare","errorCode":null,"errorMessage":"could not append Cloudflare Root CAs to cloudflared certificate pool","messagePattern":"could not append Cloudflare Root CAs to cloudflared certificate pool","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"tlsconfig/origin_ca.go","lineNumber":54,"sourceCode":"\t// Windows users should be notified that they can use the flag\n\tif runtime.GOOS == \"windows\" && originCAPoolFilename == \"\" {\n\t\tlog.Info().Msgf(\"cloudflared does not support loading the system root certificate pool on Windows. Please use --%s <PATH> to specify the path to the certificate pool\", OriginCAPoolFlag)\n\t}\n\n\treturn originCertPool, nil\n}\n\nfunc LoadCustomOriginCA(originCAFilename string) (*x509.CertPool, error) {\n\t// First, obtain the system certificate pool\n\tcertPool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\tcertPool = x509.NewCertPool()\n\t}\n\n\t// Next, append the Cloudflare CAs into the system pool\n\tcfRootCA, err := GetCloudflareRootCA()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"could not append Cloudflare Root CAs to cloudflared certificate pool\")\n\t}\n\tfor _, cert := range cfRootCA {\n\t\tcertPool.AddCert(cert)\n\t}\n\n\tif originCAFilename == \"\" {\n\t\treturn certPool, nil\n\t}\n\n\t// nolint: gosec\n\tcustomOriginCA, err := os.ReadFile(originCAFilename)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, fmt.Sprintf(\"unable to read the file %s\", originCAFilename))\n\t}\n\n\tif !certPool.AppendCertsFromPEM(customOriginCA) {\n\t\treturn nil, fmt.Errorf(\"error appending custom CA to cert pool\")\n\t}","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/tlsconfig/origin_ca.go#L36-L72","documentation":"LoadCustomOriginCA builds the certificate pool used by cloudflared and first ensures the Cloudflare root CAs are appended. This error means GetCloudflareRootCA failed to load/parse the embedded Cloudflare roots, so a trustworthy pool cannot be constructed.","triggerScenarios":"GetCloudflareRootCA returns an error during LoadCustomOriginCA — the embedded Cloudflare root CA data cannot be parsed into certificates.","commonSituations":"Essentially only seen with corrupted builds, FIPS build issues, or code modifications breaking the embedded CA data; rare in the field.","solutions":["Reinstall/rebuild cloudflared from an official release","Check the wrapped error to confirm which CA loading step failed","If building from source, verify the embedded CA assets are intact and unparsed changes reverted","Report to cloudflared issues with version and build (FIPS?) details"],"exampleFix":"// before\ncfRootCA, err := GetCloudflareRootCA()\nif err != nil {\n    return nil, errors.Wrap(err, \"could not append Cloudflare Root CAs to cloudflared certificate pool\")\n}\n// after\n// no code fix: reinstall official build\n// cloudflared update | brew upgrade cloudflared","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"pool, err := tlsconfig.LoadCustomOriginCA(path)\nif err != nil && strings.Contains(err.Error(), \"Cloudflare Root CAs\") {\n    return fmt.Errorf(\"cloudflared build integrity problem; reinstall official binary: %w\", err)\n}","preventionTips":["Install cloudflared from official packages only","Avoid patching embedded CA assets when building from source","Re-verify installs after upgrades or FIPS rebuilds"],"tags":["tls","certificates","build"],"backgroundTag":"checksum-mismatch","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}