docker/cli · error

no CA information available

Error message

no CA information available

What it means

Thrown by displayTrustRoot (cli/command/swarm/ca.go:144) when the inspected swarm's ClusterInfo.TLSInfo.TrustRoot is empty. `docker swarm ca` prints the root CA certificate; if the node has no trust root (not initialized as a swarm, CA not yet generated, or manager not converged), there is nothing to display.

Solutions

1. Initialize or join a swarm so a CA is established: `docker swarm init`.
2. Wait a moment for the manager to converge, then retry `docker swarm ca`.
3. Verify swarm state with `docker info` (Swarm: active).

Example fix

// before (node not yet in a swarm)
docker swarm ca   # -> no CA information available

// after
docker swarm init
docker swarm ca   # prints the root CA

res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})
if err != nil { return err }
if res.Swarm.ClusterInfo.TLSInfo.TrustRoot == "" {
	return errors.New("no trust root yet; initialize or wait for swarm convergence")
}

When it happens

Trigger: Running `docker swarm ca` on a node where SwarmInspect returns an empty TrustRoot — e.g. before `docker swarm init`, on a freshly-joined node whose CA hasn't propagated, or a manager mid-recovery.

Common situations: Fresh engine with no swarm; manager still converging after init/join; external CA misconfiguration; running on a worker where cluster info is incomplete.

Related errors

• file contents must be in PEM format
• the -- flag requires that a -- flag and/or -- flag be…
• node ID not found in /info
• when using secret driver secret data must be empty
• error reading from STDIN: data is empty

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/9f7a673ff37d32c1. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/swarm/ca.go:144

	err := jsonstream.Display(ctx, pipeReader, dockerCLI.Out())
	if err == nil {
		err = <-errChan
	}
	if err != nil {
		return err
	}

	res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})
	if err != nil {
		return err
	}
	return displayTrustRoot(dockerCLI.Out(), res)
}

func displayTrustRoot(out io.Writer, info client.SwarmInspectResult) error {
	if info.Swarm.ClusterInfo.TLSInfo.TrustRoot == "" {
		return errors.New("no CA information available")
	}
	_, _ = fmt.Fprintln(out, strings.TrimSpace(info.Swarm.ClusterInfo.TLSInfo.TrustRoot))
	return nil
}

View on GitHub (pinned to 4f84911bfe)