What causes "can not read leaf certificate from %s" in hashicorp/terraform?

Ensure ip_cert.pem exists in the certificates directory: ls -la $certsDir/ip_cert.pem.

can not read leaf certificate from %s

Error message

can not read leaf certificate from %s

What it means

Returned during InstancePrincipalWithCerts setup when getCertificateFileBytes fails to read the leaf certificate file (ip_cert.pem) from the certificates directory. The certs directory defaults to the working directory or is overridden by the test_certificates_location environment variable.

Source

Thrown at internal/backend/remote-state/oci/auth.go:203

		logger.Debug(" Configuration provided by: %s", cfg)

		configProviders = append(configProviders, cfg)
	case strings.ToLower(AuthInstancePrincipalWithCertsSetting):
		logger.Info("Attempting to authenticate using instance principal with certificates")

		if p.region == "" {
			return nil, fmt.Errorf("unable to determine region from Terraform backend configuration while using Instance Principal with certificates")
		}

		defaultCertsDir, err := os.Getwd()
		if err != nil {
			return nil, fmt.Errorf("can not get working directory for current os platform")
		}

		certsDir := filepath.Clean(getEnvSettingWithDefault("test_certificates_location", defaultCertsDir))
		leafCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "ip_cert.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read leaf certificate from %s", filepath.Join(certsDir, "ip_cert.pem"))
		}

		leafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "ip_key.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read leaf private key from %s", filepath.Join(certsDir, "ip_key.pem"))
		}

		leafPassphraseBytes := []byte{}
		if _, err := os.Stat(certsDir + "/leaf_passphrase"); !os.IsNotExist(err) {
			leafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + "leaf_passphrase"))
			if err != nil {
				return nil, fmt.Errorf("can not read leafPassphraseBytes from %s", filepath.Join(certsDir+"leaf_passphrase"))
			}
		}

		intermediateCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "intermediate.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read intermediate certificate from %s", filepath.Join(certsDir, "intermediate.pem"))

View on GitHub (pinned to d32a084675)

Solutions

Ensure ip_cert.pem exists in the certificates directory: ls -la $certsDir/ip_cert.pem.
Set the test_certificates_location environment variable to the correct absolute directory containing the test certs.
Generate or copy the test certificate files into the expected directory.
Verify file permissions allow read access by the terraform process.

Example fix

// before
// test_certificates_location not set, working dir has no ip_cert.pem

// after
export test_certificates_location=/home/user/test-certs
terraform init

Defensive patterns

Strategy: validation

Validate before calling

func validateTestCerts(certsDir string) error {
    required := []string{"ip_cert.pem", "ip_key.pem", "intermediate.pem"}
    for _, f := range required {
        p := filepath.Join(certsDir, f)
        if _, err := os.Stat(p); err != nil {
            return fmt.Errorf("missing test cert %s: %w", p, err)
        }
    }
    return nil
}

Try / catch

// Validate test certs before init:
certsDir := os.Getenv("test_certificates_location")
if certsDir == "" {
    certsDir, _ = os.Getwd()
}
if err := validateTestCerts(certsDir); err != nil {
    log.Fatal(err)
}

Prevention

Set test_certificates_location to an explicit absolute path.
Pre-validate all required cert files exist before running terraform.
Keep test certificate generation scripts alongside your test suite.

When it happens

Trigger: auth="InstancePrincipalWithCerts" is set and the file {certsDir}/ip_cert.pem does not exist, is not readable, or the certs directory path is wrong.

Common situations: test_certificates_location env var points to the wrong directory; certificates were not generated/copied for local testing; working directory is not where the test certs live; permission issue on the file.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/9359f1ff3ac2cd5f. Report an issue: GitHub.