{"record":{"id":"df1212733c3a0cd5","repo":"hyperledger/fabric","slug":"error-loading-tls-root-certificate-s","errorCode":null,"errorMessage":"error loading TLS root certificate (%s)","messagePattern":"error loading TLS root certificate \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/peer/config.go","lineNumber":426,"sourceCode":"\t\tif serverConfig.SecOpts.RequireClientCert {\n\t\t\tvar clientRoots [][]byte\n\t\t\tfor _, file := range viper.GetStringSlice(\"peer.tls.clientRootCAs.files\") {\n\t\t\t\tclientRoot, err := os.ReadFile(\n\t\t\t\t\tconfig.TranslatePath(filepath.Dir(viper.ConfigFileUsed()), file),\n\t\t\t\t)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn serverConfig,\n\t\t\t\t\t\tfmt.Errorf(\"error loading client root CAs (%s)\", err)\n\t\t\t\t}\n\t\t\t\tclientRoots = append(clientRoots, clientRoot)\n\t\t\t}\n\t\t\tserverConfig.SecOpts.ClientRootCAs = clientRoots\n\t\t}\n\t\t// check for root cert\n\t\tif config.GetPath(\"peer.tls.rootcert.file\") != \"\" {\n\t\t\trootCert, err := os.ReadFile(config.GetPath(\"peer.tls.rootcert.file\"))\n\t\t\tif err != nil {\n\t\t\t\treturn serverConfig, fmt.Errorf(\"error loading TLS root certificate (%s)\", err)\n\t\t\t}\n\t\t\tserverConfig.SecOpts.ServerRootCAs = [][]byte{rootCert}\n\t\t}\n\t}\n\t// get the default keepalive options\n\tserverConfig.KaOpts = comm.DefaultKeepaliveOptions\n\t// check to see if interval is set for the env\n\tif viper.IsSet(\"peer.keepalive.interval\") {\n\t\tserverConfig.KaOpts.ServerInterval = viper.GetDuration(\"peer.keepalive.interval\")\n\t}\n\t// check to see if timeout is set for the env\n\tif viper.IsSet(\"peer.keepalive.timeout\") {\n\t\tserverConfig.KaOpts.ServerTimeout = viper.GetDuration(\"peer.keepalive.timeout\")\n\t}\n\t// check to see if minInterval is set for the env\n\tif viper.IsSet(\"peer.keepalive.minInterval\") {\n\t\tserverConfig.KaOpts.ServerMinInterval = viper.GetDuration(\"peer.keepalive.minInterval\")\n\t}","sourceCodeStart":408,"sourceCodeEnd":444,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/peer/config.go#L408-L444","documentation":"GetServerConfig builds the peer's comm.ServerConfig, including TLS options. When peer.tls.rootcert.file is set, it reads that file to populate ServerRootCAs; if os.ReadFile fails (missing file, bad path, permission denied), the read error is wrapped with this message and returned, aborting server config creation.","triggerScenarios":"Calling GetServerConfig (directly or via serve/createChaincodeServer) while peer.tls.rootcert.file is configured in core.yaml/environment but points to a nonexistent, unreadable, or empty-path-resolved file.","commonSituations":"Docker/Kubernetes deployments mounting TLS secrets at a different path than core.yaml expects; typo in peer.tls.rootcert.file; file not mounted before peer startup; permission denied for the peer process user; relative path resolved against wrong working directory.","solutions":["Verify the file at peer.tls.rootcert.file exists and is readable by the peer process (ls -l / cat the path).","Fix the path in core.yaml or CORE_PEER_TLS_ROOTCERT_FILE to an absolute path.","If running in a container, ensure the secret/configmap volume is mounted before the peer starts and the path matches.","Check file permissions (readable by the peer's OS user).","If TLS is not intended, remove peer.tls.rootcert.file from config so the block is skipped."],"exampleFix":"// before (core.yaml)\npeer:\n  tls:\n    rootcert.file: tls/ca.crt   # file does not exist\n// after\npeer:\n  tls:\n    rootcert.file: /etc/hyperledger/fabric/tls/ca.crt  # absolute, existing path","handlingStrategy":"validation","validationCode":"path := config.GetPath(\"peer.tls.rootcert.file\")\nif path != \"\" {\n  if fi, err := os.Stat(path); err != nil {\n    return fmt.Errorf(\"TLS root cert unreadable at %s: %w\", path, err)\n  } else if fi.IsDir() {\n    return fmt.Errorf(\"%s is a directory, expected a PEM file\", path)\n  }\n}","typeGuard":null,"tryCatchPattern":"serverConfig, err := GetServerConfig()\nif err != nil && strings.Contains(err.Error(), \"error loading TLS root certificate\") {\n  log.Fatalf(\"fix peer.tls.rootcert.file path/permissions: %v\", err)\n}","preventionTips":["Use absolute paths for TLS files","Mount secrets before peer start","Preflight-stat all configured TLS paths","Match container mount paths to core.yaml exactly"],"tags":["tls","config","file-io","hyperledger-fabric"],"backgroundTag":"tls-root-cert-load-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}