What causes "unable to read the file %s" in cloudflare/cloudflared?

Verify the file exists and is readable at the exact configured path

unable to read the file %s

Error message

unable to read the file %s

What it means

LoadCustomOriginCA reads the custom origin CA file given via --ca-cert style config (originCAFilename) to append it to the pool. This error means os.ReadFile failed for that file — it does not exist or is not readable.

Source

Thrown at tlsconfig/origin_ca.go:67

	}

	// Next, append the Cloudflare CAs into the system pool
	cfRootCA, err := GetCloudflareRootCA()
	if err != nil {
		return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
	}
	for _, cert := range cfRootCA {
		certPool.AddCert(cert)
	}

	if originCAFilename == "" {
		return certPool, nil
	}

	// nolint: gosec
	customOriginCA, err := os.ReadFile(originCAFilename)
	if err != nil {
		return nil, errors.Wrap(err, fmt.Sprintf("unable to read the file %s", originCAFilename))
	}

	if !certPool.AppendCertsFromPEM(customOriginCA) {
		return nil, fmt.Errorf("error appending custom CA to cert pool")
	}
	return certPool, nil
}

func CreateTunnelConfig(caCert string, serverName string) (*tls.Config, error) {
	tlsConfig := &tls.Config{ServerName: serverName}
	if caCert != "" {
		caCertPEM, err := os.ReadFile(caCert) //nolint:gosec
		if err != nil {
			return nil, fmt.Errorf("read CA certificate %s: %w", caCert, err)
		}

		rootCAPool := x509.NewCertPool()
		if !rootCAPool.AppendCertsFromPEM(caCertPEM) {

View on GitHub (pinned to 2253eeeb25)

Solutions

Verify the file exists and is readable at the exact configured path
Use an absolute path in the configuration file
Fix file permissions or copy the CA to the host
Ensure containers have the file mounted

Example fix

// before
origin-ca: /etc/ssl/certs/my-origin-ca.pem  # file absent
// after
ls -l /etc/ssl/certs/my-origin-ca.pem || echo missing
# place the file, then retry cloudflared

Defensive patterns

Strategy: validation

Validate before calling

// before calling LoadCustomOriginCA
if info, err := os.Stat(path); err != nil {
    return fmt.Errorf("custom origin CA missing: %w", err)
} else if info.IsDir() {
    return fmt.Errorf("custom origin CA is a directory: %s", path)
}
f, err := os.Open(path)
if err != nil {
    return fmt.Errorf("custom origin CA unreadable: %w", err)
}
f.Close()

Try / catch

pool, err := tlsconfig.LoadCustomOriginCA(path)
if err != nil {
    if strings.Contains(err.Error(), "unable to read the file") {
        return fmt.Errorf("fix origin CA path %q: %w", path, err)
    }
    return err
}

Prevention

Use absolute paths in config files
Keep CA files present and readable on every host running cloudflared
Audit config paths after machine/container migrations

When it happens

Trigger: originCAFilename is set and os.ReadFile fails: wrong path, missing file, permission denied, or the path points to a directory.

Common situations: Typo in the CA path in config.yml; file not present on the host running cloudflared; permissions changed; config reused across machines where the path differs.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/de5fc627039736ec. Report an issue: GitHub.