dgraph-io/dgraph · error

could not read parent cert

Error message

could not read parent cert

What it means

For any non-CA certificate, getFileInfo tries to verify it against the default CA cert (ca.crt) via readCert(defaultCACert). If the parent CA certificate cannot be read/parsed, the per-file info records 'could not read parent cert' wrapping the underlying error, and CA verification is skipped.

Source

Thrown at dgraph/cmd/cert/info.go:85

		default:
			info.err = errors.Errorf("Unsupported certificate")
			return &info
		}

		switch key := cert.PublicKey.(type) {
		case *rsa.PublicKey:
			info.digest = getHexDigest(key.N.Bytes())
		case *ecdsa.PublicKey:
			info.digest = getHexDigest(elliptic.Marshal(key.Curve, key.X, key.Y))
		default:
			info.digest = "Invalid public key"
		}

		if file != defaultCACert {
			parent, err := readCert(defaultCACert)
			if err != nil {
				info.err = errors.Wrapf(err, "could not read parent cert")
				return &info
			}
			info.verifiedCA = "FAILED"
			if err := cert.CheckSignatureFrom(parent); err == nil {
				info.verifiedCA = "PASSED"
			}
		}

	case strings.HasSuffix(file, ".key"):
		switch {
		case file == defaultCAKey:
			info.commonName = dnCommonNamePrefix + " Root CA key"

		case file == defaultNodeKey:
			info.commonName = dnCommonNamePrefix + " Node key"

		case strings.HasPrefix(file, "client."):
			info.commonName = dnCommonNamePrefix + " Client key"

View on GitHub (pinned to 759e242be6)

Solutions

1. Ensure ca.crt exists in the TLS directory (regenerate with `dgraph cert create --ca` if needed)
2. Check file permissions so the running user can read ca.crt
3. Verify ca.crt parses (openssl x509 -in tls/ca.crt -noout) and re-create it if corrupt

Example fix

// before
tls/: node.crt, node.key (ca.crt deleted)
dgraph cert info  # could not read parent cert
// after
dgraph cert create --ca  # regenerate CA, then rerun dgraph cert info

if _, err := os.Stat(filepath.Join(tlsDir, "ca.crt")); err != nil {
    return fmt.Errorf("ca.crt missing in %s: regenerate with `dgraph cert create --ca`", tlsDir)
}
// optionally verify it parses: openssl x509 -in tls/ca.crt -noout

When it happens

Trigger: Running `dgraph cert info` when ca.crt is missing, unreadable (permissions), empty, or corrupt in the TLS directory while node/client certs exist.

Common situations: CA cert deleted during cleanup, directory copied without ca.crt, partial `dgraph cert` runs, or a corrupted/truncated ca.crt after a disk issue.

Related errors

• %s: verification failed
• --duration: certificate expiration date '%s' exceeds parent
• Failed to read key block
• Unknown PEM type: %s
• Key size value is too large (x > 4096)

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/be80ae9feac10ba9. Report an issue: GitHub.