could not append Cloudflare Root CAs to cloudflared certific

Error message

could not append Cloudflare Root CAs to cloudflared certificate pool

What it means

LoadCustomOriginCA builds the certificate pool used by cloudflared and first ensures the Cloudflare root CAs are appended. This error means GetCloudflareRootCA failed to load/parse the embedded Cloudflare roots, so a trustworthy pool cannot be constructed.

Source

Thrown at tlsconfig/origin_ca.go:54

	// Windows users should be notified that they can use the flag
	if runtime.GOOS == "windows" && originCAPoolFilename == "" {
		log.Info().Msgf("cloudflared does not support loading the system root certificate pool on Windows. Please use --%s <PATH> to specify the path to the certificate pool", OriginCAPoolFlag)
	}

	return originCertPool, nil
}

func LoadCustomOriginCA(originCAFilename string) (*x509.CertPool, error) {
	// First, obtain the system certificate pool
	certPool, err := x509.SystemCertPool()
	if err != nil {
		certPool = x509.NewCertPool()
	}

	// Next, append the Cloudflare CAs into the system pool
	cfRootCA, err := GetCloudflareRootCA()
	if err != nil {
		return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
	}
	for _, cert := range cfRootCA {
		certPool.AddCert(cert)
	}

	if originCAFilename == "" {
		return certPool, nil
	}

	// nolint: gosec
	customOriginCA, err := os.ReadFile(originCAFilename)
	if err != nil {
		return nil, errors.Wrap(err, fmt.Sprintf("unable to read the file %s", originCAFilename))
	}

	if !certPool.AppendCertsFromPEM(customOriginCA) {
		return nil, fmt.Errorf("error appending custom CA to cert pool")
	}

View on GitHub (pinned to 2253eeeb25)

Solutions

Reinstall/rebuild cloudflared from an official release
Check the wrapped error to confirm which CA loading step failed
If building from source, verify the embedded CA assets are intact and unparsed changes reverted
Report to cloudflared issues with version and build (FIPS?) details

Example fix

// before
cfRootCA, err := GetCloudflareRootCA()
if err != nil {
    return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
}
// after
// no code fix: reinstall official build
// cloudflared update | brew upgrade cloudflared

Defensive patterns

Strategy: try-catch

Try / catch

pool, err := tlsconfig.LoadCustomOriginCA(path)
if err != nil && strings.Contains(err.Error(), "Cloudflare Root CAs") {
    return fmt.Errorf("cloudflared build integrity problem; reinstall official binary: %w", err)
}

Prevention

Install cloudflared from official packages only
Avoid patching embedded CA assets when building from source
Re-verify installs after upgrades or FIPS rebuilds

When it happens

Trigger: GetCloudflareRootCA returns an error during LoadCustomOriginCA — the embedded Cloudflare root CA data cannot be parsed into certificates.

Common situations: Essentially only seen with corrupted builds, FIPS build issues, or code modifications breaking the embedded CA data; rare in the field.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/dd182e42b9533ead. Report an issue: GitHub.