gravitational/teleport · error

%q is not a valid x509 certificate (%w) and can't be read as

Error message

%q is not a valid x509 certificate (%w) and can't be read as a file (%w)

What it means

getCertificatePEM accepts either an inline PEM certificate or a path to a certificate file; this error fires when the value is neither — inline parsing failed and reading it as a file also failed — and reports both underlying errors.

Source

Thrown at lib/config/fileconf.go:1533

		if err != nil {
			return nil, err
		}
		res[i] = pem
	}
	return res, nil
}

func getCertificatePEM(certOrPath string) (string, error) {
	_, parseErr := tlsutils.ParseCertificatePEM([]byte(certOrPath))
	if parseErr == nil {
		return certOrPath, nil // OK, valid inline PEM
	}

	// Try reading as a file and parsing that.
	data, err := os.ReadFile(certOrPath)
	if err != nil {
		// Don't use trace in order to keep a clean error message.
		return "", fmt.Errorf("%q is not a valid x509 certificate (%w) and can't be read as a file (%w)", certOrPath, parseErr, err)
	}
	if _, err := tlsutils.ParseCertificatePEM(data); err != nil {
		// Don't use trace in order to keep a clean error message.
		return "", fmt.Errorf("file %q contains an invalid x509 certificate: %w", certOrPath, err)
	}

	return string(data), nil // OK, valid PEM file
}

// DeviceTrust holds settings related to trusted device verification.
// Requires Teleport Enterprise.
type DeviceTrust struct {
	// Mode is the trusted device verification mode.
	// Mirrors types.DeviceTrust.Mode.
	Mode string `yaml:"mode,omitempty"`
	// AutoEnroll is the toggle for the device auto-enroll feature.
	AutoEnroll string `yaml:"auto_enroll,omitempty"`
	// EKCertAllowedCAs is an allow list of EKCert CAs. These may be specified

View on GitHub (pinned to 1283425b60)

Solutions

1. Fix the certificate value to be a valid inline PEM block or a readable file path
2. Check file permissions and that the path exists
3. Regenerate the certificate if it is corrupt

When it happens

Trigger: Thrown at lib/config/fileconf.go:1533 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/96f3b19c56098aed. Report an issue: GitHub.