What causes "can not read intermediate certificate from %s" in hashicorp/terraform?

Ensure intermediate.pem exists in the certs directory alongside ip_cert.pem and ip_key.pem.

can not read intermediate certificate from %s

Error message

can not read intermediate certificate from %s

What it means

Returned during InstancePrincipalWithCerts setup when getCertificateFileBytes fails to read the intermediate certificate file (intermediate.pem). This certificate is part of the certificate chain required for the instance principal mTLS connection and is placed into the intermediateCertificatesBytes array.

Source

Thrown at internal/backend/remote-state/oci/auth.go:221

			return nil, fmt.Errorf("can not read leaf certificate from %s", filepath.Join(certsDir, "ip_cert.pem"))
		}

		leafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "ip_key.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read leaf private key from %s", filepath.Join(certsDir, "ip_key.pem"))
		}

		leafPassphraseBytes := []byte{}
		if _, err := os.Stat(certsDir + "/leaf_passphrase"); !os.IsNotExist(err) {
			leafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + "leaf_passphrase"))
			if err != nil {
				return nil, fmt.Errorf("can not read leafPassphraseBytes from %s", filepath.Join(certsDir+"leaf_passphrase"))
			}
		}

		intermediateCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "intermediate.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read intermediate certificate from %s", filepath.Join(certsDir, "intermediate.pem"))
		}

		intermediateCertificatesBytes := [][]byte{
			intermediateCertificateBytes,
		}

		cfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)
		if err != nil {
			return nil, err
		}
		logger.Debug(" Configuration provided by: %s", cfg)

		configProviders = append(configProviders, cfg)

	case strings.ToLower(AuthSecurityToken):
		logger.Info("Attempting to authenticate using security token")
		if p.region == "" {
			return nil, fmt.Errorf("can not get %s from Terraform configuration (SecurityToken)", RegionAttrName)

View on GitHub (pinned to d32a084675)

Solutions

Ensure intermediate.pem exists in the certs directory alongside ip_cert.pem and ip_key.pem.
Set test_certificates_location to the directory containing the complete test certificate set.
Regenerate the full certificate chain including the intermediate certificate.
Verify read permissions on the file.

Example fix

// before
// certs dir missing intermediate.pem

// after
export test_certificates_location=/home/user/test-certs
ls $test_certificates_location/intermediate.pem
terraform init

Defensive patterns

Strategy: validation

Validate before calling

func validateTestCerts(certsDir string) error {
    files := map[string]string{
        "ip_cert.pem":       "leaf certificate",
        "ip_key.pem":        "leaf private key",
        "intermediate.pem":  "intermediate certificate",
    }
    for f, desc := range files {
        if _, err := os.ReadFile(filepath.Join(certsDir, f)); err != nil {
            return fmt.Errorf("cannot read %s (%s): %w", f, desc, err)
        }
    }
    return nil
}

Try / catch

// Pre-validate all certs:
if err := validateTestCerts(certsDir); err != nil {
    log.Fatal(err)
}

Prevention

Generate the complete certificate chain (leaf + intermediate) as a set.
Validate all cert files exist and are readable before terraform init.
Document the full set of required cert files for InstancePrincipalWithCerts.

When it happens

Trigger: auth="InstancePrincipalWithCerts" is set and {certsDir}/intermediate.pem is missing, unreadable, or the directory path is incorrect.

Common situations: Test certificate bundle is incomplete (leaf cert/key present but intermediate missing); test_certificates_location points to wrong directory; intermediate cert was not generated during cert setup.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/8be256e50012f8f3. Report an issue: GitHub.