cloudflare/cloudflared · error

error writing cert to %s

Error message

error writing cert to %s

What it means

After `cloudflared tunnel login` fetches and encodes the origin certificate, it writes the PEM data to the target path with os.WriteFile. If the write fails (bad directory, permissions, disk full) the error is wrapped as 'error writing cert to <path>'. Login cannot complete without persisting the certificate.

Source

Thrown at cmd/cloudflared/tunnel/login.go:127

	cert, err := credentials.DecodeOriginCert(resourceData)
	if err != nil {
		log.Error().Err(err).Msg("failed to decode origin certificate")
		return err
	}

	if isFEDRamp {
		cert.Endpoint = credentials.FedEndpoint
	}

	resourceData, err = cert.EncodeOriginCert()
	if err != nil {
		log.Error().Err(err).Msg("failed to encode origin certificate")
		return err
	}

	if err := os.WriteFile(path, resourceData, 0600); err != nil { // nolint: gosec
		return errors.Wrap(err, fmt.Sprintf("error writing cert to %s", path))
	}

	log.Info().Msgf("You have successfully logged in.\nIf you wish to copy your credentials to a server, they have been saved to:\n%s\n", path)
	return nil
}

func checkForExistingCert() (string, bool, error) {
	configPath, err := homedir.Expand(config.DefaultConfigSearchDirectories()[0])
	if err != nil {
		return "", false, err
	}
	ok, err := config.FileExists(configPath)
	if !ok && err == nil {
		// create config directory if doesn't already exist
		err = os.Mkdir(configPath, 0700)
	}
	if err != nil {
		return "", false, err

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Create the parent directory of the cert path (mkdir -p) before running login.
2. Ensure the user running cloudflared has write permission to the path (chown/chmod or run with proper privileges).
3. Check free disk space and that the filesystem is not mounted read-only.
4. Choose a different writable --origincert path (default ~/.cloudflared/cert.pem).

Example fix

// before
cloudflared tunnel login --origincert /etc/cloudflared/cert.pem  # dir missing
// after
mkdir -p /etc/cloudflared && chmod 755 /etc/cloudflared
cloudflared tunnel login --origincert /etc/cloudflared/cert.pem

// ensure the cert destination is writable before login
import os
func certPathWritable(path string) error {
	dir := filepath.Dir(path)
	if err := os.MkdirAll(dir, 0755); err != nil { return err }
	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0600)
	if err != nil { return err }
	_ = f.Close()
	return nil
}

if err := os.WriteFile(path, resourceData, 0600); err != nil {
	return errors.Wrap(err, fmt.Sprintf("error writing cert to %s", path))
}

When it happens

Trigger: Running `cloudflared tunnel login --origincert /some/path` where /some/path's directory does not exist, the file is not writable, or the filesystem is read-only/full.

Common situations: Custom --origincert paths in non-existent directories; running as non-root in a root-owned directory; read-only container filesystems; disk quota exceeded in home directories.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

• failed to copy %s to %s: %w
• the argument path must be a directory
• The file-writing error is: %v / The delete tunnel error is:
• create config dir at %s: %w
• create token file at %s: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/5d5219f911729ba1. Report an issue: GitHub.