gofiber/fiber · critical

failed to read client CA file %q: %w

Error message

failed to read client CA file %q: %w

What it means

Returned during App.Listen startup when Config.CertClientFile (the client CA certificate for mutual TLS) is set but os.ReadFile cannot read it. applyClientCert reads the PEM file to populate the ClientCAs pool and enable RequireAndVerifyClientCert. The error wraps the file path and the underlying os error.

Source

Thrown at listen.go:309

	// Serve
	if cfg.BeforeServeFunc != nil {
		if err := cfg.BeforeServeFunc(app); err != nil {
			return err
		}
	}

	served = true
	return app.server.Serve(ln)
}

func applyClientCert(tlsConfig *tls.Config, certClientFile string) error {
	if certClientFile == "" {
		return nil
	}

	clientCACert, err := os.ReadFile(filepath.Clean(certClientFile))
	if err != nil {
		return fmt.Errorf("failed to read client CA file %q: %w", certClientFile, err)
	}

	clientCertPool := x509.NewCertPool()
	if ok := clientCertPool.AppendCertsFromPEM(clientCACert); !ok {
		return fmt.Errorf("failed to parse client CA certificate from %q", certClientFile)
	}

	tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
	tlsConfig.ClientCAs = clientCertPool

	return nil
}

// Listener serves HTTP requests from the given listener.
// You should enter custom ListenConfig to customize startup. (prefork, startup message, graceful shutdown...)
func (app *App) Listener(ln net.Listener, config ...ListenConfig) error {
	cfg := listenConfigDefault(config...)

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Verify the client CA file exists and is readable: ls -l on the path.
2. Use an absolute path for the CA bundle.
3. Confirm the file is PEM-encoded (BEGIN CERTIFICATE).
4. Include the CA bundle in the container image / secret mount.
5. If mTLS is not intended, remove the CertClientFile setting.

Example fix

// before
app.Listen(":443", fiber.ListenConfig{
    CertFile:     "/tls/cert.pem",
    CertKeyFile:  "/tls/key.pem",
    CertClientFile: "ca.pem", // wrong relative path
})

// after
app.Listen(":443", fiber.ListenConfig{
    CertFile:       "/tls/cert.pem",
    CertKeyFile:    "/tls/key.pem",
    CertClientFile: "/tls/client-ca.pem",
})

// Validate the client CA file before Listen
if certClientFile != "" {
    if _, err := os.ReadFile(filepath.Clean(certClientFile)); err != nil {
        log.Fatalf("cannot read client CA file: %v", err)
    }
}

if err := app.Listen(":443", fiber.ListenConfig{
    CertFile: certFile, CertKeyFile: keyFile, CertClientFile: caFile,
}); err != nil {
    log.Fatalf("startup failed: %v", err)
}

When it happens

Trigger: Calling app.Listen(":443", fiber.ListenConfig{CertClientFile: "/etc/ca/client-ca.pem"}) where the file is missing, unreadable, or the path is wrong. mTLS is being configured but the CA bundle cannot be loaded.

Common situations: Client CA bundle not included in the deployment, wrong path, permission issues, or the file is empty/corrupt. Since ClientAuth is set to RequireAndVerifyClientCert right after, clients will be rejected until this is resolved.

Related errors

• tls: cannot load TLS key pair from certFile=%q and keyFile=%
• failed to parse client CA certificate from %q
• tls: AutoCertManager cannot be combined with CertFile/CertKe
• proxy: HTTPS to HTTP redirect blocked
• failed to listen: %w

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/f9ef8138c599df7f.json. Report an issue: GitHub.