hashicorp/terraform · error

failed to append custom cert to the pool

Error message

failed to append custom cert to the pool

What it means

Returned by buildHttpClient() (or the client construction function containing this logic) when AppendCertsFromPEM fails to add the custom certificate from the file pointed to by the OCI custom cert environment variable. AppendCertsFromPEM returns false (and thus !ok is true) when the PEM data is empty or not valid PEM-encoded certificate data.

Source

Thrown at internal/backend/remote-state/oci/auth.go:437

	if domainNameOverride != "" {
		hasCorrectDomainName := getEnvSettingWithBlankDefault(HasCorrectDomainNameEnv)
		re := regexp.MustCompile(`(.*?)[-\w]+\.\w+$`) // (capture: preamble) match: d0main-name . tld end-of-string
		if hasCorrectDomainName == "" || !strings.HasSuffix(client.Host, hasCorrectDomainName) {
			client.Host = re.ReplaceAllString(client.Host, "${1}"+domainNameOverride) // non-match conveniently returns original string
		}
	}

	customCertLoc := getEnvSettingWithBlankDefault(CustomCertLocationEnv)

	if customCertLoc != "" {
		cert, err := os.ReadFile(customCertLoc)
		if err != nil {
			return &client, err
		}
		pool := x509.NewCertPool()
		if ok := pool.AppendCertsFromPEM(cert); !ok {
			return nil, fmt.Errorf("failed to append custom cert to the pool")
		}
		// install the certificates in the client
		httpClient.Transport.(*http.Transport).TLSClientConfig.RootCAs = pool
	}

	if acceptLocalCerts := getEnvSettingWithBlankDefault(AcceptLocalCerts); acceptLocalCerts != "" {
		if boolVal, err := strconv.ParseBool(acceptLocalCerts); err == nil {
			httpClient.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = boolVal
		}
	}

	return &client, nil
}
func getClientHostOverride() string {
	// Get the host URL override for clients

	clientHostOverridesString := getEnvSettingWithBlankDefault(ClientHostOverridesEnv)
	if clientHostOverridesString == "" {

View on GitHub (pinned to d32a084675)

Solutions

  1. Ensure the custom cert file is PEM-encoded (starts with '-----BEGIN CERTIFICATE-----').
  2. If you have a DER cert, convert it: openssl x509 -inform DER -in cert.der -outform PEM -out cert.pem.
  3. Verify the PEM file is valid: openssl x509 -in cert.pem -text -noout.
  4. Remove the custom cert environment variable if a custom CA is not needed.
  5. Check the file is not empty or corrupted: cat the file and look for proper PEM headers/footers.

Example fix

// before
export OCI_SDK_CUSTOM_CERT=/path/to/cert.der  # binary DER, not PEM
terraform init

// after
openssl x509 -inform DER -in /path/to/cert.der -outform PEM -out /path/to/cert.pem
export OCI_SDK_CUSTOM_CERT=/path/to/cert.pem
terraform init
Defensive patterns

Strategy: validation

Validate before calling

func validateCustomCertPEM(certPath string) error {
    data, err := os.ReadFile(certPath)
    if err != nil {
        return fmt.Errorf("cannot read custom cert: %w", err)
    }
    pool := x509.NewCertPool()
    if !pool.AppendCertsFromPEM(data) {
        // Check if it's DER
        if _, err := x509.ParseCertificate(data); err == nil {
            return fmt.Errorf("custom cert at %s is DER-encoded, not PEM — convert with: openssl x509 -inform DER -outform PEM", certPath)
        }
        return fmt.Errorf("custom cert at %s is not valid PEM", certPath)
    }
    return nil
}

Try / catch

// Validate custom cert before terraform init:
certPath := os.Getenv("OCI_SDK_CUSTOM_CERT") // or the actual env var name
if certPath != "" {
    if err := validateCustomCertPEM(certPath); err != nil {
        log.Fatal(err)
    }
}

Prevention

When it happens

Trigger: The environment variable for custom certificate location (CustomCertLocationEnv, e.g., OCI_SDK_CUSTOM_CERT) is set to a file that either contains non-PEM data, is empty, or contains malformed/corrupt PEM. The code reads the file successfully but pool.AppendCertsFromPEM returns false.

Common situations: User pointed the custom cert env var at a DER-encoded (binary) certificate instead of PEM; the cert file is empty or a placeholder; the PEM is truncated or corrupted; user pointed at the wrong file (e.g., a private key file instead of a certificate); expired or otherwise unparseable certificate content.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/5bb023c8416347ca. Report an issue: GitHub.