What causes "error loading the certificate pool" in cloudflare/cloudflared?

Verify the file contains valid PEM certificates (openssl x509 -in -text -noout)

error loading the certificate pool

Error message

error loading the certificate pool

What it means

After optionally reading the custom CA file, LoadOriginCA builds the certificate pool via loadOriginCertPool. This error means that internal call failed — e.g. the custom pool bytes contain no valid certificates or an internal step errored.

Source

Thrown at tlsconfig/origin_ca.go:33

const (
	OriginCAPoolFlag = "origin-ca-pool"
)

func LoadOriginCA(originCAPoolFilename string, log *zerolog.Logger) (*x509.CertPool, error) {
	var originCustomCAPool []byte

	if originCAPoolFilename != "" {
		var err error
		// nolint:gosec
		originCustomCAPool, err = os.ReadFile(originCAPoolFilename)
		if err != nil {
			return nil, errors.Wrap(err, fmt.Sprintf("unable to read the file %s for --%s", originCAPoolFilename, OriginCAPoolFlag))
		}
	}

	originCertPool, err := loadOriginCertPool(originCustomCAPool, log)
	if err != nil {
		return nil, errors.Wrap(err, "error loading the certificate pool")
	}

	// Windows users should be notified that they can use the flag
	if runtime.GOOS == "windows" && originCAPoolFilename == "" {
		log.Info().Msgf("cloudflared does not support loading the system root certificate pool on Windows. Please use --%s <PATH> to specify the path to the certificate pool", OriginCAPoolFlag)
	}

	return originCertPool, nil
}

func LoadCustomOriginCA(originCAFilename string) (*x509.CertPool, error) {
	// First, obtain the system certificate pool
	certPool, err := x509.SystemCertPool()
	if err != nil {
		certPool = x509.NewCertPool()
	}

	// Next, append the Cloudflare CAs into the system pool

View on GitHub (pinned to 2253eeeb25)

Solutions

Verify the file contains valid PEM certificates (openssl x509 -in <file> -text -noout)
Regenerate or re-export the origin CA pool in PEM format
Check the wrapped error for the underlying cause (parse vs. root-CA failure)
Update cloudflared if the Cloudflare root bundle fails to load

Example fix

// before
--origin-ca-pool /path/to/key.pem   # not a certificate
// after
openssl x509 -in /path/to/ca.pem -text -noout  # validate first
cloudflared ... --origin-ca-pool /path/to/ca.pem

Defensive patterns

Strategy: validation

Validate before calling

// verify the CA file parses as PEM before passing it in
pemBytes, err := os.ReadFile(path)
if err != nil {
    return err
}
block, _ := pem.Decode(pemBytes)
if block == nil || block.Type != "CERTIFICATE" {
    return fmt.Errorf("%s does not contain a PEM certificate", path)
}
if _, err := x509.ParseCertificate(block.Bytes); err != nil {
    return fmt.Errorf("invalid certificate in %s: %w", path, err)
}

Try / catch

pool, err := tlsconfig.LoadOriginCA(path, log)
if err != nil && strings.Contains(err.Error(), "error loading the certificate pool") {
    return fmt.Errorf("CA pool at %q is not a valid certificate bundle: %w", path, err)
}

Prevention

Only pass PEM certificate bundles (not keys) to --origin-ca-pool
Validate files with `openssl x509 -in <file> -text -noout` first
Keep the file non-empty and free of editor artifacts

When it happens

Trigger: loadOriginCertPool returns an error because the custom CA bytes cannot be parsed into an x509 pool or the Cloudflare root CA load inside it fails.

Common situations: Passing a file that is not a PEM certificate (e.g. a private key or config file) to --origin-ca-pool; empty file; corrupted or expired certificates.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/d970c717dcc926c2. Report an issue: GitHub.