{"record":{"id":"dfb60ba964658825","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-create-http-client-for-snapshot-createurl","errorCode":null,"errorMessage":"cannot create http client for -snapshot.createURL=%q: %w","messagePattern":"cannot create http client for -snapshot\\.createURL=%q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/snapshot/snapshot.go","lineNumber":43,"sourceCode":")\n\ntype snapshot struct {\n\tStatus   string `json:\"status\"`\n\tSnapshot string `json:\"snapshot\"`\n\tMsg      string `json:\"msg\"`\n}\n\n// Create creates a snapshot via the provided api endpoint and returns the snapshot name\nfunc Create(ctx context.Context, createSnapshotURL string) (string, error) {\n\tlogger.Infof(\"Creating snapshot\")\n\tu, err := url.Parse(createSnapshotURL)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"cannot parse -snapshot.createURL: %w\", err)\n\t}\n\n\thc, err := GetHTTPClient()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"cannot create http client for -snapshot.createURL=%q: %w\", createSnapshotURL, err)\n\t}\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, createSnapshotURL, nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"cannot create request for -snapshot.createURL=%q: %w\", createSnapshotURL, err)\n\t}\n\tresp, err := hc.Do(req)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer resp.Body.Close()\n\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"unexpected status code returned from %q: %d; expecting %d; response body: %q\", u.Redacted(), resp.StatusCode, http.StatusOK, body)\n\t}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/snapshot/snapshot.go#L25-L61","documentation":"After parsing the -snapshot.createURL, snapshot.Create builds an HTTP client (with TLS/proxy settings). If GetHTTPClient fails — typically a TLS configuration problem such as a missing or unreadable certificate/key file — creation cannot proceed and this error wraps the cause with the target URL for context.","triggerScenarios":"Calling snapshot.Create (or running the tool) where TLS flags like -tlsCAFile/-tlsCertFile/-tlsKeyFile point to nonexistent, unreadable, or malformed files, causing GetHTTPClient to error.","commonSituations":"Running inside a container where the mounted CA/cert files are missing or have wrong permissions, typos in TLS flag paths, or enabling -tls without providing the CA used by the server.","solutions":["Verify all TLS flag paths (-tls*, -snapshot.* TLS options) point to existing, readable files inside the running environment.","Read the wrapped error (%w cause) to identify which cert/key failed and why.","Mount/repair the CA and client certificate files if running in Docker/Kubernetes.","If the endpoint is plain HTTP, remove the TLS flags so no client TLS config is attempted."],"exampleFix":"// before\n-snapshot.createURL=https://vm:8428/snapshot/create -tlsCAFile=/missing/ca.crt\n// after\n-snapshot.createURL=https://vm:8428/snapshot/create -tlsCAFile=/etc/vm/ca.crt","handlingStrategy":"validation","validationCode":"for _, f := range []string{tlsCAFile, tlsCertFile, tlsKeyFile} {\n\tif f != \"\" {\n\t\tif _, err := os.Stat(f); err != nil {\n\t\t\tlog.Fatalf(\"TLS file missing: %s: %v\", f, err)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify TLS cert/CA files are mounted and readable in containers before launch","Use the wrapped error cause to identify which file failed","Drop TLS flags when the target is plain HTTP"],"tags":["snapshot","http-client","tls","network"],"backgroundTag":"tls-config-error","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}