fluent/fluentd · error · Fluent::ConfigError

cert_path does not contain a valid certificate

Error message

cert_path does not contain a valid certificate

What it means

cert_option_certificates_from_file (cert_option.rb:187-195) reads cert_path and scans it for PEM blocks matching '-----BEGIN CERTIFICATE-----' ... '-----END CERTIFICATE-----'; if the regex finds none, it raises this Fluent::ConfigError. The file exists but holds no PEM certificate — it may be DER-encoded binary, a bare private key, an empty file, or the wrong file entirely — so OpenSSL::X509::Certificate can never be constructed from it.

Source

Thrown at lib/fluent/plugin_helper/cert_option.rb:193

        cert, key = cert_option_generate_pair(generate_opts)
        raise "BUG: certificate digest algorithm not set" unless generate_opts[:digest]

        cert_option_add_extensions(cert, [
          ['basicConstraints', 'CA:FALSE'],
          ['nsCertType', 'server']
        ])

        cert.sign(key, generate_opts[:digest].to_s)
        return cert, key, nil
      end

      def cert_option_certificates_from_file(path)
        data = File.read(path)
        pattern = Regexp.compile('-+BEGIN CERTIFICATE-+\r?\n(?:[^-]*\r?\n)+-+END CERTIFICATE-+\r?\n?', Regexp::MULTILINE)
        list = []
        data.scan(pattern){|match| list << OpenSSL::X509::Certificate.new(match) }
        if list.length == 0
          raise Fluent::ConfigError, "cert_path does not contain a valid certificate"
        end
        list
      end
    end
  end
end

View on GitHub (pinned to dd45c6e18d)

Solutions

1. Verify the file actually contains a PEM block: grep -c 'BEGIN CERTIFICATE' /etc/fluent/cert.pem must be >= 1
2. If the cert is DER, convert it: openssl x509 -inform der -in cert.der -out cert.pem and point cert_path at cert.pem
3. Fix path mix-ups: cert_path must reference the certificate, private_key_path the key
4. For secret volumes, ensure the mount is populated before fluentd starts (initContainer, correct secret name, no optional mounting of missing secrets)

Example fix

# before
$ file /etc/fluent/cert.pem
/etc/fluent/cert.pem: data   # DER binary
# => cert_path does not contain a valid certificate

# after
$ openssl x509 -inform der -in /etc/fluent/cert.der -out /etc/fluent/cert.pem
$ head -1 /etc/fluent/cert.pem
-----BEGIN CERTIFICATE-----

data = File.read('/etc/fluent/cert.pem')
raise 'no PEM certificate found' unless data.match?(/-+BEGIN CERTIFICATE-+/)

def pem_cert_file?(path)
  File.readable?(path) && File.read(path).match?(/-----BEGIN CERTIFICATE-----/)
end

begin
  agent.configure(conf)
rescue Fluent::ConfigError => e
  if e.message.include?('does not contain a valid certificate')
    abort 'convert DER to PEM (openssl x509 -inform der) or fix the cert file, then restart'
  end
  raise
end

When it happens

Trigger: cert_path pointing at a DER (.crt binary) certificate: the PEM regex never matches; cert_path accidentally referencing the private key file (key.pem) instead of cert.pem; an empty or whitespace-only cert file from a failed secret mount; a file whose BEGIN/END lines are mangled by templating (e.g. leading spaces or missing dashes) so the pattern misses.

Common situations: Kubernetes secret volumes not mounted yet / mounted empty at container start; certs downloaded from a vendor in DER format; copy-paste of certificate contents truncating the footer; CRLF or indentation damage in config-managed cert files.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• private_key_path is required when cert_path is specified
• ca_private_key_path is required when ca_cert_path is specifi
• no valid cert options configured. specify either 'cert_path'
• Cannot enable FIPS compliant mode. OpenSSL FIPS configuratio
• Plugin @id or path for <storage> required when 'persistent'

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/8e7d81c636eba4e8. Report an issue: GitHub.