{"record":{"id":"f03796ec295efa68","repo":"docker/cli","slug":"failed-to-retrieve-context-tls-info-ca-pem-seems","errorCode":null,"errorMessage":"failed to retrieve context tls info: ca.pem seems invalid","messagePattern":"failed to retrieve context tls info: ca\\.pem seems invalid","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/docker/load.go","lineNumber":54,"sourceCode":"\t\treturn Endpoint{}, err\n\t}\n\treturn Endpoint{\n\t\tEndpointMeta: m,\n\t\tTLSData:      tlsData,\n\t}, nil\n}\n\n// tlsConfig extracts a context docker endpoint TLS config\nfunc (ep *Endpoint) tlsConfig() (*tls.Config, error) {\n\tif ep.TLSData == nil && !ep.SkipTLSVerify {\n\t\t// there is no specific tls config\n\t\treturn nil, nil\n\t}\n\tvar tlsOpts []func(*tls.Config)\n\tif ep.TLSData != nil && ep.TLSData.CA != nil {\n\t\tcertPool := x509.NewCertPool()\n\t\tif !certPool.AppendCertsFromPEM(ep.TLSData.CA) {\n\t\t\treturn nil, errors.New(\"failed to retrieve context tls info: ca.pem seems invalid\")\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.RootCAs = certPool\n\t\t})\n\t}\n\tif ep.TLSData != nil && ep.TLSData.Key != nil && ep.TLSData.Cert != nil {\n\t\tkeyBytes := ep.TLSData.Key\n\t\tpemBlock, _ := pem.Decode(keyBytes)\n\t\tif pemBlock == nil {\n\t\t\treturn nil, errors.New(\"no valid private key found\")\n\t\t}\n\t\tif x509.IsEncryptedPEMBlock(pemBlock) { //nolint:staticcheck // SA1019: x509.IsEncryptedPEMBlock is deprecated, and insecure by design\n\t\t\treturn nil, errors.New(\"private key is encrypted - support for encrypted private keys has been removed, see https://docs.docker.com/go/deprecated/\")\n\t\t}\n\n\t\tx509cert, err := tls.X509KeyPair(ep.TLSData.Cert, keyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to retrieve context tls info: %w\", err)","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/docker/load.go#L36-L72","documentation":"Returned by Endpoint.tlsConfig when the context's stored CA PEM bytes fail to be parsed as a certificate. AppendCertsFromPEM returns false when the input is not valid PEM or contains no parseable certificates, so the trust pool cannot be built and TLS verification would be impossible.","triggerScenarios":"A docker context created with TLS material whose ca.pem is corrupt, truncated, empty, or not a PEM-encoded certificate. Importing a context archive with a malformed ca.pem. Manually editing the TLS files under ~/.docker/contexts/.../tls.","commonSituations":"A ca.pem was copied incompletely (e.g., missing the END CERTIFICATE line). The file contains a private key or arbitrary text instead of a certificate. A context was exported from a system with a different TLS setup and re-imported with bad data.","solutions":["Re-import or regenerate the context's CA certificate so ca.pem contains valid PEM CERTIFICATE blocks.","Verify the file: 'openssl x509 -in ca.pem -noout -text' should succeed.","Recreate the context with 'docker context create' pointing at valid TLS files."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate ca.pem is a usable certificate before creating the context.\npool := x509.NewCertPool()\nif !pool.AppendCertsFromPEM(caBytes) {\n    return errors.New(\"ca.pem is not a valid PEM certificate\")\n}","typeGuard":"func isValidCAPEM(b []byte) bool {\n    pool := x509.NewCertPool()\n    return pool.AppendCertsFromPEM(b)\n}","tryCatchPattern":null,"preventionTips":["Validate certificates with 'openssl x509 -in ca.pem -noout'.","Recreate contexts from known-good TLS material.","Avoid hand-editing TLS files under ~/.docker/contexts."],"tags":["context","tls","certificates","ca-pem","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}