goharbor/harbor · error

invalid CA certificate

Error message

invalid CA certificate: %w

What it means

Validation in ValidateCACertificate: the supplied CA certificate string, after PEM normalization, could not be parsed as x509 certificate(s) — i.e. it is not valid PEM certificate data. %w wraps the parse error; it fires when a user supplies a corrupted, truncated, or non-PEM CA bundle (empty input is allowed).

Solutions

1. Provide the CA certificate as valid PEM (BEGIN/END CERTIFICATE blocks)
2. Check for corruption, truncation or wrong encoding (e.g. DER instead of PEM)
3. Re-export the CA certificate from the source authority

When it happens

Trigger: Thrown at src/common/http/transport.go:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/7af938e2958839b4. Report an issue: GitHub.

Appendix: source

Thrown at src/common/http/transport.go:121

func ValidateCACertificate(caCert string) error {
	caCert = normalizePEM(caCert)
	if caCert == "" {
		return nil
	}

	// Attempt to parse one or more certificates from the provided PEM
	certs, err := parseCertificatesFromPEM(caCert)
	if err != nil {
		return fmt.Errorf("invalid CA certificate: %w", err)
	}

View on GitHub (pinned to 7b2fd08cc5)