hyperledger/fabric · error

failed to add ca-file PEM to cert pool

Error message

failed to add ca-file PEM to cert pool

What it means

After reading the --ca-file PEM bytes, osnadmin calls AppendCertsFromPEM to add them to an x509 cert pool. If the bytes contain no valid PEM-encoded certificates, the call returns false and this error is returned. It means the file was readable but is not a parseable PEM certificate.

Source

Thrown at cmd/osnadmin/main.go:96

	//
	// flag validation
	//
	var (
		osnURL        string
		caCertPool    *x509.CertPool
		tlsClientCert tls.Certificate
	)
	// TLS enabled
	if *caFile != "" {
		osnURL = fmt.Sprintf("https://%s", *orderer)
		var err error
		caCertPool = x509.NewCertPool()
		caFilePEM, err := os.ReadFile(*caFile)
		if err != nil {
			return "", 1, fmt.Errorf("reading orderer CA certificate: %s", err)
		}
		if !caCertPool.AppendCertsFromPEM(caFilePEM) {
			return "", 1, errors.New("failed to add ca-file PEM to cert pool")
		}

		tlsClientCert, err = tls.LoadX509KeyPair(*clientCert, *clientKey)
		if err != nil {
			return "", 1, fmt.Errorf("loading client cert/key pair: %s", err)
		}
	} else { // TLS disabled
		osnURL = fmt.Sprintf("http://%s", *orderer)
	}

	var marshaledConfigBlock []byte
	if *configBlockPath != "" {
		marshaledConfigBlock, err = os.ReadFile(*configBlockPath)
		if err != nil {
			return "", 1, fmt.Errorf("reading config block: %s", err)
		}

		err = validateBlockChannelID(marshaledConfigBlock, *joinChannelID)

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Verify the file contains a '-----BEGIN CERTIFICATE-----' block: head the file.
2. Point --ca-file at the orderer's CA certificate (e.g. tlsca cert), not a key or client cert.
3. If the cert is DER, convert it: openssl x509 -inform der -in cert.der -out ca.crt.
4. Check file size — an empty or truncated file must be re-exported from the orderer's MSP/tls directory.

Example fix

// before (wrong file — private key)
osnadmin channel join ... --ca-file /etc/fabric/tls/server.key
// after (correct CA cert)
osnadmin channel join ... --ca-file /etc/fabric/tls/ca.crt

pem, err := os.ReadFile(caFile)
if err != nil { log.Fatal(err) }
pool := x509.NewCertPool()
if !pool.AppendCertsFromPEM(pem) {
    log.Fatalf("%s does not contain a valid PEM certificate", caFile)
}

When it happens

Trigger: --ca-file pointing to a private key, an empty file, a DER/binary cert (not PEM), a config file by mistake, or a PEM bundle with only invalid/truncated blocks.

Common situations: Passing the TLS private key or the client cert instead of the CA cert; certs generated with wrong encoding; file corrupted by copy-paste or base64 left encoded; empty mounted secret.

Related errors

• loading client cert/key pair: %s
• %s: wrong PEM encoding
• no PEM data found in cert[% x]
• enrollment certificate isn't a valid PEM block
• enrollment certificate should be a certificate, got a %s ins

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/28a10cf891039e84. Report an issue: GitHub.