grafana/k6 · error

failed to read root certificate from %q: %w

Error message

failed to read root certificate from %q: %w

What it means

buildTLSConfig for the OpenTelemetry output reads the root CA file given via its config option with os.ReadFile; this error wraps that read failure (missing file, permissions, path typo). The exporter requires a valid CA bundle to build its tls.Config and refuses to start.

Source

Thrown at internal/output/opentelemetry/tls.go:31

func buildTLSConfig(
	insecureSkipVerify null.Bool,
	certPath, clientCertPath, clientKeyPath null.String,
) (*tls.Config, error) {
	set := false
	tlsConfig := &tls.Config{
		MinVersion: tls.VersionTLS13,
	}

	if insecureSkipVerify.Valid {
		tlsConfig.InsecureSkipVerify = insecureSkipVerify.Bool
		set = true
	}

	// Load the root certificate
	if certPath.Valid {
		b, err := os.ReadFile(certPath.String) //nolint:forbidigo
		if err != nil {
			return nil, fmt.Errorf("failed to read root certificate from %q: %w", certPath.String, err)
		}

		cp := x509.NewCertPool()
		if ok := cp.AppendCertsFromPEM(b); !ok {
			return nil, errors.New("failed to append root certificate to the pool")
		}

		tlsConfig.RootCAs = cp
		set = true
	}

	// Load the client certificate
	if clientCertPath.Valid {
		cert, err := tls.LoadX509KeyPair(clientCertPath.String, clientKeyPath.String)
		if err != nil {
			return nil, fmt.Errorf("failed to load client certificate: %w", err)
		}

View on GitHub (pinned to 01ffac6f24)

Solutions

1. Verify the certificate file path and read permissions
2. Use an absolute path for K6_OTEL_TLS_CERT
3. Remove the setting if no custom CA is needed

When it happens

Trigger: Thrown at internal/output/opentelemetry/tls.go:31 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of grafana/k6@01ffac6f24 (2026-08-18). Data as JSON: /api/errors/0cf78aca0b2ed56f. Report an issue: GitHub.