{"record":{"id":"fbce57607d29d995","repo":"thanos-io/thanos","slug":"unable-to-use-specified-ca-cert-s","errorCode":null,"errorMessage":"unable to use specified CA cert %s","messagePattern":"unable to use specified CA cert (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exthttp/tlsconfig.go","lineNumber":38,"sourceCode":"\tKeyFile string `yaml:\"key_file\"`\n\t// Used to verify the hostname for the targets.\n\tServerName string `yaml:\"server_name\"`\n\t// Disable target certificate validation.\n\tInsecureSkipVerify bool `yaml:\"insecure_skip_verify\"`\n}\n\n// NewTLSConfig creates a new tls.Config from the given TLSConfig.\nfunc NewTLSConfig(cfg *TLSConfig) (*tls.Config, error) {\n\ttlsConfig := &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify}\n\n\t// If a CA cert is provided then let's read it in.\n\tif len(cfg.CAFile) > 0 {\n\t\tb, err := readCAFile(cfg.CAFile)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif !updateRootCA(tlsConfig, b) {\n\t\t\treturn nil, fmt.Errorf(\"unable to use specified CA cert %s\", cfg.CAFile)\n\t\t}\n\t}\n\n\tif len(cfg.ServerName) > 0 {\n\t\ttlsConfig.ServerName = cfg.ServerName\n\t}\n\t// If a client cert & key is provided then configure TLS config accordingly.\n\tif len(cfg.CertFile) > 0 && len(cfg.KeyFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client cert file %q specified without client key file\", cfg.CertFile)\n\t} else if len(cfg.KeyFile) > 0 && len(cfg.CertFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client key file %q specified without client cert file\", cfg.KeyFile)\n\t} else if len(cfg.CertFile) > 0 && len(cfg.KeyFile) > 0 {\n\t\t// Verify that client cert and key are valid.\n\t\tif _, err := cfg.getClientCertificate(nil); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttlsConfig.GetClientCertificate = cfg.getClientCertificate\n\t}","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/exthttp/tlsconfig.go#L20-L56","documentation":"NewTLSConfig fails because the CA file provided via the ca-file setting was read but its bytes could not be parsed as PEM certificates (updateRootCA returned false), so the root certificate pool would be empty.","triggerScenarios":"Thrown at pkg/exthttp/tlsconfig.go:38 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the CA file contains valid PEM-encoded certificates.","Ensure the file is not empty or truncated.","Re-export the CA bundle in PEM (not DER) format."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}