goharbor/harbor · error

internal TLS enabled but can't get cert file

Error message

internal TLS enabled but can't get cert file %w

What it means

Startup error in GetInternalTLSConfig: internal TLS is enabled but the certificate/key pair could not be loaded from the paths given by the internal TLS cert/key environment variables (%w wraps the os/fs error, e.g. missing file or bad permissions). It fires when the cert file at the configured path cannot be read.

Solutions

1. Verify the internal TLS cert path env var points to an existing cert file
2. Check file permissions so the Harbor process can read the cert/key
3. Regenerate or remount the internal certificate if it is missing in the container

When it happens

Trigger: Thrown at src/common/http/tls.go:54 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/b704b26cfeff02f0. Report an issue: GitHub.

Appendix: source

Thrown at src/common/http/tls.go:54

// GetInternalTLSConfig return a tls.Config for internal https communicate
func GetInternalTLSConfig() (*tls.Config, error) {
	// generate key pair
	certPath := os.Getenv(internalTLSCertPath)
	if _, err := os.Stat(certPath); err != nil {
		return nil, fmt.Errorf("internal TLS enabled but can't get cert file %w", err)
	}

View on GitHub (pinned to 7b2fd08cc5)