{"record":{"id":"e505902aa74aa519","repo":"cloudflare/cloudflared","slug":"unable-to-get-x509-system-cert-pool","errorCode":null,"errorMessage":"unable to get x509 system cert pool","messagePattern":"unable to get x509 system cert pool","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tlsconfig/origin_ca.go","lineNumber":94,"sourceCode":"func CreateTunnelConfig(caCert string, serverName string) (*tls.Config, error) {\n\ttlsConfig := &tls.Config{ServerName: serverName}\n\tif caCert != \"\" {\n\t\tcaCertPEM, err := os.ReadFile(caCert) //nolint:gosec\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read CA certificate %s: %w\", caCert, err)\n\t\t}\n\n\t\trootCAPool := x509.NewCertPool()\n\t\tif !rootCAPool.AppendCertsFromPEM(caCertPEM) {\n\t\t\treturn nil, fmt.Errorf(\"parse CA certificate %s\", caCert)\n\t\t}\n\t\ttlsConfig.RootCAs = rootCAPool\n\t}\n\n\tif tlsConfig.RootCAs == nil {\n\t\trootCAPool, err := x509.SystemCertPool()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"unable to get x509 system cert pool\")\n\t\t}\n\t\tcfRootCA, err := GetCloudflareRootCA()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"could not append Cloudflare Root CAs to cloudflared certificate pool\")\n\t\t}\n\t\tfor _, cert := range cfRootCA {\n\t\t\trootCAPool.AddCert(cert)\n\t\t}\n\t\ttlsConfig.RootCAs = rootCAPool\n\t}\n\n\tif tlsConfig.ServerName == \"\" && !tlsConfig.InsecureSkipVerify {\n\t\treturn nil, fmt.Errorf(\"either ServerName or InsecureSkipVerify must be specified in the tls.Config\")\n\t}\n\treturn tlsConfig, nil\n}\n\nfunc loadOriginCertPool(originCAPoolPEM []byte, log *zerolog.Logger) (*x509.CertPool, error) {","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/tlsconfig/origin_ca.go#L76-L112","documentation":"CreateTunnelConfig in tlsconfig/origin_ca.go builds a *tls.Config for origin connections. When no explicit CA cert is supplied, it falls back to the operating system's root certificate store via x509.SystemCertPool(). If Go cannot load the system pool, the call fails and this wrapped error is returned instead of a TLS config.","triggerScenarios":"Calling tlsconfig.CreateTunnelConfig(caCert=\"\", serverName=...) when x509.SystemCertPool() returns an error — typically because the OS trust store is missing or unreadable (empty/missing /etc/ssl/certs, broken SSL_CERT_FILE/SSL_CERT_DIR env vars, minimal container images without ca-certificates).","commonSituations":"Running cloudflared or embedding cloudflared in a scratch/Distroless Docker image with no ca-certificates package; deleting or corrupting the system CA bundle; setting SSL_CERT_FILE/SSL_CERT_DIR to a nonexistent path; older Go versions on Windows where SystemCertPool was unsupported.","solutions":["Install the OS CA bundle (e.g. apt-get install ca-certificates, apk add ca-certificates) or use a base image that includes it.","Check SSL_CERT_FILE and SSL_CERT_DIR environment variables point to a readable PEM bundle and unset them if wrong.","Pass an explicit CA file to CreateTunnelConfig so tlsConfig.RootCAs is populated and the system pool is never loaded.","Verify with `trust list` (p11-kit) or `ls /etc/ssl/certs` that the trust store exists and is non-empty."],"exampleFix":"// before\ntlsConfig, err := tlsconfig.CreateTunnelConfig(\"\", \"origin.example.com\")\n// after (provide explicit CA so the system pool is not needed)\ntlsConfig, err := tlsconfig.CreateTunnelConfig(\"/etc/cloudflared/origin-ca.pem\", \"origin.example.com\")","handlingStrategy":"validation","validationCode":"if _, err := x509.SystemCertPool(); err != nil {\n    // fall back to bundled roots or fail fast with guidance\n    return fmt.Errorf(\"system trust store unavailable: %w; install ca-certificates or pass an explicit CA pool\", err)\n}","typeGuard":null,"tryCatchPattern":"pooled, err := tlsconfig.CreateTunnelConfig(caCert, serverName)\nif err != nil && strings.Contains(err.Error(), \"x509 system cert pool\") {\n    log.Error().Err(err).Msg(\"system CA bundle missing; install ca-certificates or set --origin-ca-pool\")\n}","preventionTips":["Use container base images that include ca-certificates (debian-slim, alpine with the package installed).","Never unset or point SSL_CERT_FILE/SSL_CERT_DIR at nonexistent paths.","Prefer passing an explicit origin CA pool in deterministic environments."],"tags":["tls","x509","certificates","system-configuration"],"backgroundTag":"missing-dependency","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}