juicedata/juicefs · error

build tls config from %s: %s

Error message

build tls config from %s: %s

What it means

Building the TLS configuration for the etcd client failed; the query string of the etcd endpoint URL (u.RawQuery) carries TLS parameters (cert/key/CA paths or insecure settings) that could not be applied. The query string itself is printed as the offending input.

Source

Thrown at pkg/object/etcd.go:191

	if err != nil {
		return nil, fmt.Errorf("parse %s: %s", addr, err)
	}
	hosts := strings.Split(u.Host, ",")
	for i, h := range hosts {
		h, _, err := net.SplitHostPort(h)
		if err != nil {
			hosts[i] = net.JoinHostPort(h, "2379")
		}
	}
	conf := etcd.Config{
		Endpoints:        hosts,
		Username:         user,
		Password:         passwd,
		AutoSyncInterval: time.Minute,
	}
	conf.TLS, err = buildTlsConfig(u)
	if err != nil {
		return nil, fmt.Errorf("build tls config from %s: %s", u.RawQuery, err)
	}
	c, err := etcd.New(conf)
	if err != nil {
		return nil, err
	}
	return &etcdClient{DefaultObjectStorage{}, c, c.KV, u.Host}, nil
}

func init() {
	Register("etcd", newEtcd)
}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Verify the cacert/cert/key files exist, are readable, and match each other
2. Check server-name matches the certificate's CN/SAN

When it happens

Trigger: Thrown at pkg/object/etcd.go:191 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/1b9b44d273c52ba5. Report an issue: GitHub.