gravitational/teleport · error

file %q contains an invalid x509 certificate: %w

Error message

file %q contains an invalid x509 certificate: %w

What it means

Validation error from getCertificatePEM in the file config loader. The given certOrPath value was neither a valid inline PEM x509 certificate nor a readable file containing one (os.ReadFile failed, or the file's contents failed ParseCertificatePEM). It fires while parsing Teleport file configs (e.g. server/app definitions) whose cert field is malformed or points to a missing/unreadable path.

Source

Thrown at lib/config/fileconf.go:1537

	}
	return res, nil
}

func getCertificatePEM(certOrPath string) (string, error) {
	_, parseErr := tlsutils.ParseCertificatePEM([]byte(certOrPath))
	if parseErr == nil {
		return certOrPath, nil // OK, valid inline PEM
	}

	// Try reading as a file and parsing that.
	data, err := os.ReadFile(certOrPath)
	if err != nil {
		// Don't use trace in order to keep a clean error message.
		return "", fmt.Errorf("%q is not a valid x509 certificate (%w) and can't be read as a file (%w)", certOrPath, parseErr, err)
	}
	if _, err := tlsutils.ParseCertificatePEM(data); err != nil {
		// Don't use trace in order to keep a clean error message.
		return "", fmt.Errorf("file %q contains an invalid x509 certificate: %w", certOrPath, err)
	}

	return string(data), nil // OK, valid PEM file
}

// DeviceTrust holds settings related to trusted device verification.
// Requires Teleport Enterprise.
type DeviceTrust struct {
	// Mode is the trusted device verification mode.
	// Mirrors types.DeviceTrust.Mode.
	Mode string `yaml:"mode,omitempty"`
	// AutoEnroll is the toggle for the device auto-enroll feature.
	AutoEnroll string `yaml:"auto_enroll,omitempty"`
	// EKCertAllowedCAs is an allow list of EKCert CAs. These may be specified
	// as a PEM encoded certificate or as a path to a PEM encoded certificate.
	//
	// If present, only TPM devices that present an EKCert that is signed by a
	// CA specified here may be enrolled (existing enrollments are

View on GitHub (pinned to 1283425b60)

Solutions

1. Verify the file contains a complete, valid PEM certificate (correct BEGIN/END CERTIFICATE lines, no truncation)
2. Check for accidental inclusion of private keys or wrong files in the config
3. Regenerate or re-download the certificate

When it happens

Trigger: Thrown at lib/config/fileconf.go:1537 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/3efca63978278d5c. Report an issue: GitHub.