{"record":{"id":"de5fc627039736ec","repo":"cloudflare/cloudflared","slug":"unable-to-read-the-file-s","errorCode":null,"errorMessage":"unable to read the file %s","messagePattern":"unable to read the file (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tlsconfig/origin_ca.go","lineNumber":67,"sourceCode":"\t}\n\n\t// Next, append the Cloudflare CAs into the system pool\n\tcfRootCA, err := GetCloudflareRootCA()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"could not append Cloudflare Root CAs to cloudflared certificate pool\")\n\t}\n\tfor _, cert := range cfRootCA {\n\t\tcertPool.AddCert(cert)\n\t}\n\n\tif originCAFilename == \"\" {\n\t\treturn certPool, nil\n\t}\n\n\t// nolint: gosec\n\tcustomOriginCA, err := os.ReadFile(originCAFilename)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, fmt.Sprintf(\"unable to read the file %s\", originCAFilename))\n\t}\n\n\tif !certPool.AppendCertsFromPEM(customOriginCA) {\n\t\treturn nil, fmt.Errorf(\"error appending custom CA to cert pool\")\n\t}\n\treturn certPool, nil\n}\n\nfunc CreateTunnelConfig(caCert string, serverName string) (*tls.Config, error) {\n\ttlsConfig := &tls.Config{ServerName: serverName}\n\tif caCert != \"\" {\n\t\tcaCertPEM, err := os.ReadFile(caCert) //nolint:gosec\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read CA certificate %s: %w\", caCert, err)\n\t\t}\n\n\t\trootCAPool := x509.NewCertPool()\n\t\tif !rootCAPool.AppendCertsFromPEM(caCertPEM) {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/tlsconfig/origin_ca.go#L49-L85","documentation":"LoadCustomOriginCA reads the custom origin CA file given via --ca-cert style config (originCAFilename) to append it to the pool. This error means os.ReadFile failed for that file — it does not exist or is not readable.","triggerScenarios":"originCAFilename is set and os.ReadFile fails: wrong path, missing file, permission denied, or the path points to a directory.","commonSituations":"Typo in the CA path in config.yml; file not present on the host running cloudflared; permissions changed; config reused across machines where the path differs.","solutions":["Verify the file exists and is readable at the exact configured path","Use an absolute path in the configuration file","Fix file permissions or copy the CA to the host","Ensure containers have the file mounted"],"exampleFix":"// before\norigin-ca: /etc/ssl/certs/my-origin-ca.pem  # file absent\n// after\nls -l /etc/ssl/certs/my-origin-ca.pem || echo missing\n# place the file, then retry cloudflared","handlingStrategy":"validation","validationCode":"// before calling LoadCustomOriginCA\nif info, err := os.Stat(path); err != nil {\n    return fmt.Errorf(\"custom origin CA missing: %w\", err)\n} else if info.IsDir() {\n    return fmt.Errorf(\"custom origin CA is a directory: %s\", path)\n}\nf, err := os.Open(path)\nif err != nil {\n    return fmt.Errorf(\"custom origin CA unreadable: %w\", err)\n}\nf.Close()","typeGuard":null,"tryCatchPattern":"pool, err := tlsconfig.LoadCustomOriginCA(path)\nif err != nil {\n    if strings.Contains(err.Error(), \"unable to read the file\") {\n        return fmt.Errorf(\"fix origin CA path %q: %w\", path, err)\n    }\n    return err\n}","preventionTips":["Use absolute paths in config files","Keep CA files present and readable on every host running cloudflared","Audit config paths after machine/container migrations"],"tags":["file","tls","configuration"],"backgroundTag":"file-not-found","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}