gofr-dev/gofr · critical

invalid certificate file

Error message

invalid certificate file

What it means

errInvalidCertificateFile is declared in pkg/gofr/http_server.go and returned by validateCertificateAndKeyFiles when the configured TLS certificate file does not exist (os.Stat reports IsNotExist). gofr checks cert/key files at startup before enabling HTTPS and aborts with this error rather than failing later during TLS handshake.

Source

Thrown at pkg/gofr/http_server.go:32

	gofrHTTP "gofr.dev/pkg/gofr/http"
	"gofr.dev/pkg/gofr/http/middleware"
	"gofr.dev/pkg/gofr/logging"
	"gofr.dev/pkg/gofr/websocket"
)

type httpServer struct {
	router      *gofrHTTP.Router
	port        int
	ws          *websocket.Manager
	srvMu       sync.Mutex // guards srv, which run() writes on the serve goroutine and Shutdown() reads on the caller goroutine
	srv         *http.Server
	certFile    string
	keyFile     string
	staticFiles map[string]string
}

var (
	errInvalidCertificateFile = errors.New("invalid certificate file")
	errInvalidKeyFile         = errors.New("invalid key file")
)

// logRouterChoice reports the route matcher the router resolved to.
//
// It stays quiet for the default, which every service gets and nobody needs told
// about. It speaks up for the two cases that are worth a line: the opt-in matcher
// being active, and a GOFR_ROUTER value that was not understood — the latter
// falls back to mux, which looks exactly like never having set the variable, so a
// typo would otherwise cost the opt-in with nothing said.
func logRouterChoice(logger logging.Logger, r *gofrHTTP.Router) {
	requested := os.Getenv(gofrHTTP.RouterEnvVar)
	if requested == "" {
		return
	}

	if !strings.EqualFold(requested, r.Matcher()) {
		logger.Warnf("unrecognized %s value %q, using the %q router; valid values are %q and %q",

View on GitHub (pinned to 187eb24962)

Solutions

1. Verify the certificate path exists: ls the exact configured path from the service's working directory
2. Fix the env/config value (HTTPS_CERT_FILE or gofr config) to the correct absolute path
3. In containers, confirm the cert secret/volume is mounted before startup
4. If using self-signed/dev certs, generate them first (e.g. openssl req -x509 ...) at the configured location

Example fix

// before
export HTTPS_CERT_FILE=./certs/server.crt   # file not present
// after
export HTTPS_CERT_FILE=/etc/ssl/gofr/server.crt  # verified existing path
ls -l /etc/ssl/gofr/server.crt

func checkCert(path string) error {
    if path == "" {
        return errors.New("certificate path not configured")
    }
    if _, err := os.Stat(path); err != nil {
        return fmt.Errorf("certificate file missing: %w", err)
    }
    return nil
}

func isInvalidCertificate(err error) bool {
    return errors.Is(err, errInvalidCertificateFile)
}

if err := server.Run(); err != nil {
    if errors.Is(err, errInvalidCertificateFile) {
        log.Fatalf("TLS cert missing: %v", err)
    }
    return err
}

When it happens

Trigger: Starting a gofr HTTP server with HTTPS_CERT_FILE (or equivalent config) pointing to a certificate path that does not exist on disk; validateCertificateAndKeyFiles stats the cert file and os.IsNotExist(err) is true.

Common situations: Typo in the cert path; mounting certificates at a different location in Docker/K8s than the configured path; secret not mounted before the service starts; relative path resolved from a different working directory.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• %w : %v
• invalid key file
• failed to append CA certificate
• failed to read CA certificate from %s: %w
• %w: deleting document: %w

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/ca03fc7f7ca6b841. Report an issue: GitHub.