{"record":{"id":"df417fbff73a48da","repo":"risingwavelabs/risingwave","slug":"failed-to-parse-ca-certificate","errorCode":null,"errorMessage":"Failed to parse CA certificate","messagePattern":"Failed to parse CA certificate","errorType":"exception","errorClass":"PsqlError","httpStatus":null,"severity":"error","filePath":"src/utils/pgwire/src/ldap_auth.rs","lineNumber":103,"sourceCode":"            cert,\n            key,\n            req_cert,\n        }\n    }\n\n    /// Initialize rustls ClientConfig based on TLS configuration\n    fn init_client_config(&self) -> PsqlResult<rustls::ClientConfig> {\n        let tls_client_config = rustls::ClientConfig::builder();\n\n        let mut root_cert_store = rustls::RootCertStore::empty();\n        if let Some(tls_config) = &self.ca_cert {\n            let ca_cert_bytes = fs::read(tls_config).map_err(|e| {\n                PsqlError::StartupError(anyhow!(e).context(\"Failed to read CA certificate\").into())\n            })?;\n            for cert in CertificateDer::pem_slice_iter(&ca_cert_bytes) {\n                let cert = cert.map_err(|e| {\n                    PsqlError::StartupError(\n                        anyhow!(e).context(\"Failed to parse CA certificate\").into(),\n                    )\n                })?;\n                root_cert_store.add(cert).map_err(|err| {\n                    PsqlError::StartupError(\n                        anyhow!(err).context(\"Failed to add CA certificate\").into(),\n                    )\n                })?;\n            }\n        } else {\n            // If ca certs is not present, load system native certs.\n            for cert in\n                rustls_native_certs::load_native_certs().expect(\"could not load platform certs\")\n            {\n                root_cert_store.add(cert).map_err(|err| {\n                    PsqlError::StartupError(\n                        anyhow!(err)\n                            .context(\"Failed to add native CA certificate\")\n                            .into(),","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/utils/pgwire/src/ldap_auth.rs#L85-L121","documentation":"The CA certificate file was read but its bytes could not be parsed as PEM certificate(s) by rustls-pemfile's `CertificateDer::pem_slice_iter`. The parse error is wrapped with anyhow context \"Failed to parse CA certificate\" inside a StartupError.","triggerScenarios":"`init_client_config` iterates `CertificateDer::pem_slice_iter(&ca_cert_bytes)` on the file read from the configured ca_cert path and the iterator yields Err — the file is not valid PEM (DER-encoded file, concatenated junk, HTML error page, empty file).","commonSituations":"Providing a DER (.der/.crt binary) certificate where PEM is required; downloading a cert and saving the HTML response; corrupted or truncated certificate file.","solutions":["Convert the certificate to PEM format (`openssl x509 -inform der -in cert.der -out cert.pem`).","Verify the file contains `-----BEGIN CERTIFICATE-----` blocks.","Re-download/re-export the CA certificate to fix corruption.","Validate with `openssl x509 -in cert.pem -text -noout` before configuring it."],"exampleFix":"// before: DER cert configured\nopenssl x509 -outform der -in ca.crt -out ca.pem  # wrong\n// after: PEM cert\nopenssl x509 -outform pem -in ca.crt -out ca.pem","handlingStrategy":"validation","validationCode":"fn is_pem_cert(path: &str) -> Result<(), String> {\n    let s = std::fs::read_to_string(path).map_err(|e| e.to_string())?;\n    if s.contains(\"-----BEGIN CERTIFICATE-----\") { Ok(()) }\n    else { Err(\"file is not PEM encoded\".into()) }\n}","typeGuard":null,"tryCatchPattern":"match err {\n    PsqlError::StartupError(e) if e.to_string().contains(\"Failed to parse CA certificate\") => {\n        eprintln!(\"convert cert to PEM: {}\", e);\n    }\n    other => return Err(other),\n}","preventionTips":["Always distribute certificates in PEM format.","Run `openssl x509 -in cert.pem -noout` to validate before deploying.","Don't save cert downloads blindly — verify the file content."],"tags":["ldap","tls","certificate","pem","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}