juicedata/juicefs · error

build tls config from %s: %s

Error message

build tls config from %s: %s

What it means

When building the etcd client, JuiceFS constructs a TLS config from the connection URL's query parameters (via `buildTlsConfig`). Failure reading certificate/key/CA files or invalid PEM content produces 'build tls config from %s: %s' with the raw query string included.

Source

Thrown at pkg/meta/tkv_etcd.go:338

		return nil, fmt.Errorf("parse %s: %s", addr, err)
	}
	passwd, _ := u.User.Password()
	hosts := strings.Split(u.Host, ",")
	for i, h := range hosts {
		h, _, err := net.SplitHostPort(h)
		if err != nil {
			hosts[i] = net.JoinHostPort(h, "2379")
		}
	}
	conf := etcd.Config{
		Endpoints:        hosts,
		Username:         u.User.Username(),
		Password:         passwd,
		AutoSyncInterval: time.Minute,
	}
	conf.TLS, err = buildTlsConfig(u)
	if err != nil {
		return nil, fmt.Errorf("build tls config from %s: %s", u.RawQuery, err)
	}
	c, err := etcd.New(conf)
	if err != nil {
		return nil, err
	}
	maxCompactSlices = 100
	var prefix string = u.Path + "\xFD"
	return withPrefix(&etcdClient{c, etcd.NewKV(c)}, []byte(prefix)), nil
}

func init() {
	Register("etcd", newKVMeta)
	drivers["etcd"] = newEtcdClient
}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Read the wrapped error to see which file failed (not found / permission denied / PEM parse) and fix that path or permission
2. Verify the query parameters in the metadata URL point to existing cert, key, and cacert files on the client machine
3. Validate PEM files: `openssl x509 -in cert.pem -noout` / `openssl rsa -in key.pem -check`
4. In containers, mount the secret/cert files and confirm they exist before mount; drop TLS params if connecting over plain http

Example fix

// before
etcd://host:2379?cert=/etc/certs/client.crt&key=/etc/certs/client.key&cacert=/etc/certs/missing-ca.crt
// after
cp ca.crt /etc/certs/ca.crt && chmod 600 /etc/certs/client.key
etcd://host:2379?cert=/etc/certs/client.crt&key=/etc/certs/client.key&cacert=/etc/certs/ca.crt

// Verify TLS files before mounting
for f in (cert, key, cacert):
    if not os.path.isfile(f): raise SystemExit(f'TLS file missing: {f}')
    os.access(f, os.R_OK) or raise SystemExit(f'TLS file unreadable: {f}')
subprocess.run(['openssl','x509','-in',cert,'-noout'], check=True)

When it happens

Trigger: Metadata URL contains TLS query parameters (e.g. `?cert=...&key=...&cacert=...` or `sslMode`-style flags) that cannot be turned into a tls.Config: files missing, unreadable (permissions), or malformed PEM, or unsupported parameter combinations.

Common situations: Wrong paths to cert/key/CA files; certs not mounted/copied into containers; file permission issues; certificate files that are actually empty or corrupted; mixing https endpoint with missing CA config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• parse %s: %s
• error loading certificate and key file: %s
• error appending CA cert to pool
• create %sor: %w
• get certificate error certFile:%s keyFile:%s error:%s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/2534b64509d5fe2f. Report an issue: GitHub.