gravitational/teleport · error

err.Error()

Error message

err.Error()

What it means

authExportPublic writes the error from exporting public CA certificates (err.Error()) plus its trace-mapped status to the response when fetching the cluster's trust-chain certs for the requested auth type fails.

Source

Thrown at lib/web/ca_export.go:39

	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"time"

	"github.com/gravitational/trace"
	"github.com/julienschmidt/httprouter"

	"github.com/gravitational/teleport/lib/client"
)

// authExportPublic returns the CA Certs that can be used to set up a chain of trust which includes the current Teleport Cluster
//
// GET /webapi/sites/:site/auth/export?type=<auth type>
// GET /webapi/auth/export?type=<auth type>
func (h *Handler) authExportPublic(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
	if err := h.authExportPublicError(w, r, p); err != nil {
		http.Error(w, err.Error(), trace.ErrorToCode(err))
		return
	}

	// Success output handled by authExportPublicError.
}

// authExportPublicError implements authExportPublic, except it returns an error
// in case of failure. Output is only written on success.
func (h *Handler) authExportPublicError(w http.ResponseWriter, r *http.Request, p httprouter.Params) error {
	err := rateLimitRequest(r, h.limiter)
	if err != nil {
		return trace.Wrap(err)
	}

	query := r.URL.Query()
	caType := query.Get("type") // validated by ExportAllAuthorities

	ctx := r.Context()

View on GitHub (pinned to 1283425b60)

Solutions

1. Verify the requested ?type= parameter is a valid auth type
2. Check auth server health and proxy-to-auth connectivity
3. Retry the export request

When it happens

Trigger: Thrown at lib/web/ca_export.go:39 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/ce479a1ec9c6b6a1. Report an issue: GitHub.