What causes "error while creating backend client" in cloudflare/cloudflared?

Run `cloudflared tunnel login` or provide --origincert pointing at a valid cert.pem

error while creating backend client

Error message

error while creating backend client

What it means

`addVirtualNetwork` wraps the error from `subcommandContext.client()` with the shared noClientMsg — the Tunnel Store API client could not be built, so virtual network creation never reaches the API. Same root cause as all noClientMsg errors: origin certificate problems or invalid API URL.

Source

Thrown at cmd/cloudflared/tunnel/subcommand_context_vnets.go:13

package tunnel

import (
	"github.com/google/uuid"
	"github.com/pkg/errors"

	"github.com/cloudflare/cloudflared/cfapi"
)

func (sc *subcommandContext) addVirtualNetwork(newVnet cfapi.NewVirtualNetwork) (cfapi.VirtualNetwork, error) {
	client, err := sc.client()
	if err != nil {
		return cfapi.VirtualNetwork{}, errors.Wrap(err, noClientMsg)
	}
	return client.CreateVirtualNetwork(newVnet)
}

func (sc *subcommandContext) listVirtualNetworks(filter *cfapi.VnetFilter) ([]*cfapi.VirtualNetwork, error) {
	client, err := sc.client()
	if err != nil {
		return nil, errors.Wrap(err, noClientMsg)
	}
	return client.ListVirtualNetworks(filter)
}

func (sc *subcommandContext) deleteVirtualNetwork(vnetId uuid.UUID, force bool) error {
	client, err := sc.client()
	if err != nil {
		return errors.Wrap(err, noClientMsg)
	}
	return client.DeleteVirtualNetwork(vnetId, force)

View on GitHub (pinned to 2253eeeb25)

Solutions

Run `cloudflared tunnel login` or provide --origincert pointing at a valid cert.pem
Verify the cert file exists and is readable at the configured path
Check --api-url is correct if overridden
Confirm automation uses absolute cert paths and correct HOME

Example fix

# before
cloudflared tunnel vnet add corp-vnet   # fails: no backend client
# after
cloudflared tunnel login
cloudflared tunnel vnet add corp-vnet --origincert /etc/cloudflared/cert.pem

Defensive patterns

Strategy: validation

Validate before calling

if info, err := os.Stat(certPath); err != nil || info.IsDir() {
    return errors.New("origin cert required for `tunnel vnet add`")
}

Try / catch

vnet, err := addVirtualNetwork(newVnet)
if err != nil && strings.Contains(err.Error(), noClientMsg) {
    // fix credentials and retry
}

Prevention

Provision cert.pem in the environment before vnet provisioning
Use absolute --origincert in CI/CD pipelines
Keep cert.pem mode 0600 and owned by the executing user
Check the wrapped error (errors.Cause) to distinguish cert vs URL problems

When it happens

Trigger: `cloudflared tunnel vnet add <name>` when credentials.Read fails (missing cert.pem / bad --origincert) or cred.Client() construction fails (bad --api-url, malformed cert).

Common situations: Provisioning vnets from automation without a logged-in cert; cert.pem not mounted in the container; wrong --origincert path; broken --api-url override.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/1179ef569daf6d4e. Report an issue: GitHub.