cloudflare/cloudflared · error

originCert cannot be nil

Error message

originCert cannot be nil

What it means

EncodeOriginCert is a method on *OriginCert; calling it on a nil receiver has no certificate to serialize, so it returns the explicit error "originCert cannot be nil". JSON marshaling a nil pointer would otherwise produce "null" and silently emit an empty PEM token, so the nil check is a guard against encoding a meaningless credential.

Source

Thrown at credentials/origin_cert.go:64

// FindDefaultOriginCertPath returns the first path that contains a cert.pem file. If none of the
// DefaultConfigSearchDirectories contains a cert.pem file, return empty string
func FindDefaultOriginCertPath() string {
	for _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {
		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, DefaultCredentialFile))
		if ok := fileExists(originCertPath); ok {
			return originCertPath
		}
	}
	return ""
}

func DecodeOriginCert(blocks []byte) (*OriginCert, error) {
	return decodeOriginCert(blocks)
}

func (cert *OriginCert) EncodeOriginCert() ([]byte, error) {
	if cert == nil {
		return nil, fmt.Errorf("originCert cannot be nil")
	}
	buffer, err := json.Marshal(cert)
	if err != nil {
		return nil, fmt.Errorf("originCert marshal failed: %v", err)
	}
	block := pem.Block{
		Type:    "ARGO TUNNEL TOKEN",
		Headers: map[string]string{},
		Bytes:   buffer,
	}
	var out bytes.Buffer
	err = pem.Encode(&out, &block)
	if err != nil {
		return nil, fmt.Errorf("pem encoding failed: %v", err)
	}
	return out.Bytes(), nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check the *OriginCert for nil before calling EncodeOriginCert
2. Inspect and handle the error from DecodeOriginCert that produced the nil cert
3. Fix the code path that left the cert unpopulated (missing/invalid cert file)
4. In tests, ensure fixtures produce a valid decoded cert before encoding

Example fix

// before
cert, _ := DecodeOriginCert(blocks)
encoded, err := cert.EncodeOriginCert() // panics into error path if cert is nil
// after
cert, err := DecodeOriginCert(blocks)
if err != nil { return nil, err }
if cert == nil { return nil, errors.New("decoded origin cert is nil") }
encoded, err := cert.EncodeOriginCert()

if cert == nil {
	return nil, errors.New("no origin cert to encode")
}

func isCertReady(cert *credentials.OriginCert) bool {
	return cert != nil
}

encoded, err := cert.EncodeOriginCert()
if err != nil {
	if err.Error() == "originCert cannot be nil" {
		// re-decode or re-fetch the cert before proceeding
	}
	return err
}

When it happens

Trigger: Invoking cert.EncodeOriginCert() where cert is a nil *OriginCert — e.g. DecodeOriginCert returned (nil, err) and the error was ignored, or a lookup returned a nil cert pointer.

Common situations: Ignoring the error from DecodeOriginCert and proceeding to re-encode; storing *OriginCert in a map/struct field that was never populated; test setups passing nil certs.

Related errors

• pem encoding failed: %v
• error parsing OriginCert: %v
• originCert marshal failed: %v
• ErrUnauthorized
• ErrBadRequest

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/f3618e5e6353f4a6. Report an issue: GitHub.