{"record":{"id":"f3618e5e6353f4a6","repo":"cloudflare/cloudflared","slug":"origincert-cannot-be-nil","errorCode":null,"errorMessage":"originCert cannot be nil","messagePattern":"originCert cannot be nil","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/origin_cert.go","lineNumber":64,"sourceCode":"// FindDefaultOriginCertPath returns the first path that contains a cert.pem file. If none of the\n// DefaultConfigSearchDirectories contains a cert.pem file, return empty string\nfunc FindDefaultOriginCertPath() string {\n\tfor _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {\n\t\toriginCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, DefaultCredentialFile))\n\t\tif ok := fileExists(originCertPath); ok {\n\t\t\treturn originCertPath\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc DecodeOriginCert(blocks []byte) (*OriginCert, error) {\n\treturn decodeOriginCert(blocks)\n}\n\nfunc (cert *OriginCert) EncodeOriginCert() ([]byte, error) {\n\tif cert == nil {\n\t\treturn nil, fmt.Errorf(\"originCert cannot be nil\")\n\t}\n\tbuffer, err := json.Marshal(cert)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"originCert marshal failed: %v\", err)\n\t}\n\tblock := pem.Block{\n\t\tType:    \"ARGO TUNNEL TOKEN\",\n\t\tHeaders: map[string]string{},\n\t\tBytes:   buffer,\n\t}\n\tvar out bytes.Buffer\n\terr = pem.Encode(&out, &block)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pem encoding failed: %v\", err)\n\t}\n\treturn out.Bytes(), nil\n}\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/credentials/origin_cert.go#L46-L82","documentation":"EncodeOriginCert is a method on *OriginCert; calling it on a nil receiver has no certificate to serialize, so it returns the explicit error \"originCert cannot be nil\". JSON marshaling a nil pointer would otherwise produce \"null\" and silently emit an empty PEM token, so the nil check is a guard against encoding a meaningless credential.","triggerScenarios":"Invoking cert.EncodeOriginCert() where cert is a nil *OriginCert — e.g. DecodeOriginCert returned (nil, err) and the error was ignored, or a lookup returned a nil cert pointer.","commonSituations":"Ignoring the error from DecodeOriginCert and proceeding to re-encode; storing *OriginCert in a map/struct field that was never populated; test setups passing nil certs.","solutions":["Check the *OriginCert for nil before calling EncodeOriginCert","Inspect and handle the error from DecodeOriginCert that produced the nil cert","Fix the code path that left the cert unpopulated (missing/invalid cert file)","In tests, ensure fixtures produce a valid decoded cert before encoding"],"exampleFix":"// before\ncert, _ := DecodeOriginCert(blocks)\nencoded, err := cert.EncodeOriginCert() // panics into error path if cert is nil\n// after\ncert, err := DecodeOriginCert(blocks)\nif err != nil { return nil, err }\nif cert == nil { return nil, errors.New(\"decoded origin cert is nil\") }\nencoded, err := cert.EncodeOriginCert()","handlingStrategy":"type-guard","validationCode":"if cert == nil {\n\treturn nil, errors.New(\"no origin cert to encode\")\n}","typeGuard":"func isCertReady(cert *credentials.OriginCert) bool {\n\treturn cert != nil\n}","tryCatchPattern":"encoded, err := cert.EncodeOriginCert()\nif err != nil {\n\tif err.Error() == \"originCert cannot be nil\" {\n\t\t// re-decode or re-fetch the cert before proceeding\n\t}\n\treturn err\n}","preventionTips":["Always check the error from DecodeOriginCert before using its result","Guard nil *OriginCert receivers before calling EncodeOriginCert","Initialize cert variables at declaration to avoid accidental nils"],"tags":["go","nil-pointer","certificate","encoding"],"backgroundTag":"null-argument","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}