{"record":{"id":"eac2f82ae9ad74ca","repo":"thanos-io/thanos","slug":"reading-client-ca","errorCode":null,"errorMessage":"reading client CA","messagePattern":"reading client CA","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tls/options.go","lineNumber":80,"sourceCode":"\n\t// Certificate is loaded during server startup to check for any errors.\n\tcertificate, err := tls.LoadX509KeyPair(certPath, keyPath)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"server credentials\")\n\t}\n\n\tmngr := &serverTLSManager{\n\t\tsrvCertPath: certPath,\n\t\tsrvKeyPath:  keyPath,\n\t\tsrvCert:     &certificate,\n\t}\n\n\ttlsCfg.GetCertificate = mngr.getCertificate\n\n\tif clientCA != \"\" {\n\t\tcaPEM, err := os.ReadFile(filepath.Clean(clientCA))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"reading client CA\")\n\t\t}\n\n\t\tcertPool := x509.NewCertPool()\n\t\tif !certPool.AppendCertsFromPEM(caPEM) {\n\t\t\treturn nil, errors.Wrap(err, \"building client CA\")\n\t\t}\n\t\ttlsCfg.ClientCAs = certPool\n\t\ttlsCfg.ClientAuth = tls.RequireAndVerifyClientCert\n\n\t\tlevel.Info(logger).Log(\"msg\", \"server TLS client verification enabled\")\n\t}\n\n\treturn tlsCfg, nil\n}\n\ntype serverTLSManager struct {\n\tsrvCertPath string\n\tsrvKeyPath  string","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tls/options.go#L62-L98","documentation":"NewServerConfig wraps an os.ReadFile failure of the client CA file with 'reading client CA'. The configured --client-ca path could not be read, so the server cannot build the client certificate pool for mTLS.","triggerScenarios":"clientCA path is set but os.ReadFile(filepath.Clean(clientCA)) fails — file missing, wrong path, or no read permission.","commonSituations":"Kubernetes secret not mounted or mounted at a different path than the flag; typo in the CA path; file permissions excluding the process user; config referencing a path valid on another host.","solutions":["Verify the CA file exists at the exact path: ls -l and cat the file","Fix the --client-ca flag or the volume/secret mount so the path matches","Grant read permission to the process user","Ensure the CA file is valid PEM so AppendCertsFromPEM also succeeds (a related 'building client CA' error follows otherwise)"],"exampleFix":"// before\n--client-ca=/etc/thanos/ca.crt  # file not mounted\n// after\n# mount secret at /etc/thanos/tls then use\n--client-ca=/etc/thanos/tls/ca.crt","handlingStrategy":"validation","validationCode":"// Pre-start check\nif _, err := os.ReadFile(clientCA); err != nil {\n    return fmt.Errorf(\"client CA unreadable at %s: %w\", clientCA, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm secret volume mount paths match flags before deploy","Ensure the process user has read access to mounted TLS files","Validate CA PEM with 'openssl x509 -in ca.crt -noout' in CI"],"tags":["tls","mtls","file-read","configuration"],"backgroundTag":"file-read-failed","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}