larksuite/cli · error

failed to load system cert pool for %s: %w

Error message

failed to load system cert pool for %s: %w

What it means

x509.SystemCertPool() failed while augmenting the system trust store for the extra CA. The code deliberately fails closed instead of silently falling back to an empty pool, which would make the transport trust ONLY the extra CA and drop all system roots.

Source

Thrown at internal/transport/tls_ca.go:48

		TargetPath:            caPath,
		Label:                 envvars.CliCAPath,
		AllowReadableByOthers: true,
	})
	if err != nil {
		return fmt.Errorf("unsafe %s %q: %w", envvars.CliCAPath, caPath, err)
	}
	pemBytes, err := vfs.ReadFile(safeCAPath)
	if err != nil {
		return fmt.Errorf("failed to read %s %q: %w", envvars.CliCAPath, caPath, err)
	}

	// Augment the system trust store. Do NOT silently discard a SystemCertPool
	// error: falling back to an empty pool would make this transport trust ONLY
	// the extra CA (dropping all system roots), which narrows trust unexpectedly
	// and could break TLS to legitimate endpoints. Fail closed instead.
	pool, err := x509.SystemCertPool()
	if err != nil {
		return fmt.Errorf("failed to load system cert pool for %s: %w", envvars.CliCAPath, err)
	}
	if pool == nil {
		pool = x509.NewCertPool()
	}
	if ok := pool.AppendCertsFromPEM(pemBytes); !ok {
		return fmt.Errorf("invalid %s %q: no certificates parsed from PEM", envvars.CliCAPath, caPath)
	}

	if t.TLSClientConfig == nil {
		t.TLSClientConfig = &tls.Config{}
	} else {
		// Clone to avoid mutating shared config from the base transport.
		t.TLSClientConfig = t.TLSClientConfig.Clone()
	}
	if t.TLSClientConfig.MinVersion == 0 || t.TLSClientConfig.MinVersion < tls.VersionTLS12 {
		t.TLSClientConfig.MinVersion = tls.VersionTLS12
	}
	t.TLSClientConfig.RootCAs = pool

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Install the OS CA certificates package (e.g. ca-certificates on Debian/Alpine images).
2. Recreate or repair the system trust store (/etc/ssl/certs, update-ca-certificates / update-ca-trust).
3. Re-run the command after the system roots are available.

Example fix

// before (Dockerfile)
FROM alpine
// after (Dockerfile)
FROM alpine
RUN apk add --no-cache ca-certificates

if _, err := x509.SystemCertPool(); err != nil {
	log.Printf("warning: system cert pool unavailable: %v", err)
}

if _, err := x509.SystemCertPool(); err != nil {
	log.Fatalf("system trust store broken (%v); install ca-certificates before running the CLI", err)
}

When it happens

Trigger: applyExtraRootCA calls x509.SystemCertPool() after successfully reading the PEM file and the OS returns an error (rare; often on constrained/embedded systems or broken crypto configuration).

Common situations: Minimal container images with no system certificate directory (e.g. missing /etc/ssl/certs); exotic platforms where SystemCertPool is unsupported; corrupted system trust store.

Related errors

• invalid %s %q: must be an absolute path to a PEM file
• unsafe %s %q: %w
• failed to read %s %q: %w
• invalid %s %q: no certificates parsed from PEM
• failed to get HTTP client for user_info: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/77270667106774dc. Report an issue: GitHub.