gofr-dev/gofr · error

failed to append CA certificate

Error message

failed to append CA certificate

What it means

errFailedCACerts is a sentinel returned by registerMySQLTLSConfig when the CA certificate file was read but its PEM contents could not be parsed into an x509 cert pool (AppendCertsFromPEM returned false). gofr wraps it as "failed to append CA certificate". It means the custom TLS trust configuration for MySQL is invalid.

Source

Thrown at pkg/gofr/datasource/sql/sql.go:40

)

const (
	sqlite            = "sqlite"
	cockroachDB       = "cockroachdb"
	defaultDBPort     = 3306
	requireSSLMode    = "require"
	tlsSkipVerify     = "tls=skip-verify"
	sslModeDisable    = "disable"
	sslModeVerifyCA   = "verify-ca"
	sslModeVerifyFull = "verify-full"
	tlsCustom         = "tls=custom"
	localhost         = "localhost"
)

var (
	errUnsupportedDialect = fmt.Errorf(
		"unsupported db dialect; supported dialects are - mysql, postgres, supabase, sqlite, %s", cockroachDB)
	errFailedCACerts = fmt.Errorf("failed to append CA certificate")
)

// DBConfig has those members which are necessary variables while connecting to database.
type DBConfig struct {
	Dialect     string
	HostName    string
	User        string
	Password    string
	Port        string
	Database    string
	SSLMode     string
	MaxIdleConn int
	MaxOpenConn int
	Charset     string
}

// redactedPassword is the fixed mask substituted for a non-empty password whenever
// a DBConfig is stringified, so the raw secret is never printed.

View on GitHub (pinned to 187eb24962)

Solutions

1. Verify the CA file contains valid PEM blocks (-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----).
2. Re-export or re-download the CA certificate in PEM format (openssl x509 -in ca.crt -out ca.pem).
3. Check the DB_TLS_CA_CERT_PATH env var points to the CA file, not the client key or a DER bundle.
4. Confirm the mounted file is non-empty and not truncated.

Example fix

// before (DER-encoded file passed as CA)
os.Setenv("DB_TLS_CA_CERT_PATH", "/certs/ca.der")
// after
os.Setenv("DB_TLS_CA_CERT_PATH", "/certs/ca.pem") // valid PEM CA bundle

pem, err := os.ReadFile(os.Getenv("DB_TLS_CA_CERT_PATH"))
if err != nil { return err }
if !x509.NewCertPool().AppendCertsFromPEM(pem) {
    return errors.New("CA file is not valid PEM")
}

When it happens

Trigger: Calling NewSQL for a mysql dialect with DB_TLS_CA_CERT_PATH set to a file that is not a valid PEM-encoded certificate, an empty file, or a file containing DER-encoded or corrupted cert data.

Common situations: Pointing DB_TLS_CA_CERT_PATH at a key file, an intermediate bundle with unexpected encoding, or a truncated download; mounting a Kubernetes secret with the wrong key; using a cert chain where none of the PEM blocks parse.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to read CA certificate from %s: %w
• failed to load client certificate: %w
• invalid certificate file
• invalid key file
• %w : %v

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/007d367f2378c2ba. Report an issue: GitHub.