risingwavelabs/risingwave · error · SchemaRegistryClientError::Build

build schema registry client error: {0}

Error message

build schema registry client error: {0}

What it means

SchemaRegistryClientError::Build is returned when reqwest fails to construct the HTTP client for the schema registry, wrapping the underlying reqwest::Error. After reading and parsing certificates and applying TLS/auth settings, reqwest::ClientBuilder::build() failed — typically a TLS backend initialization problem.

Source

Thrown at src/connector/src/schema/schema_registry/client.rs:134

#[derive(Debug, thiserror::Error)]
#[error("all request confluent registry all timeout, {context}\n{}", errs.iter().map(|e| format!("\t{}", e.as_report())).join("\n"))]
pub struct ConcurrentRequestError {
    errs: Vec<itertools::Either<RequestError, tokio::task::JoinError>>,
    context: String,
}

type SrResult<T> = Result<T, ConcurrentRequestError>;

#[derive(thiserror::Error, Debug)]
pub enum SchemaRegistryClientError {
    #[error(transparent)]
    InvalidOption(#[from] InvalidOptionError),
    #[error("read ca file error: {0}")]
    ReadFile(#[source] std::io::Error),
    #[error("parse ca file error: {0}")]
    ParsePem(#[source] reqwest::Error),
    #[error("build schema registry client error: {0}")]
    Build(#[source] reqwest::Error),
}

impl TryFrom<&ConfluentSchemaRegistryConnection> for Client {
    type Error = InvalidOptionError;

    fn try_from(value: &ConfluentSchemaRegistryConnection) -> Result<Self, Self::Error> {
        let urls = handle_sr_list(value.url.as_str())?;

        Client::new(
            urls,
            &SchemaRegistryConfig {
                username: value.username.clone(),
                password: value.password.clone(),
                ..Default::default()
            },
        )
        .map_err(|e| match e {

View on GitHub (pinned to 6469eb736d)

Solutions

1. Check that the CA cert is valid PEM (see ParsePem fix) — invalid TLS input is the most common cause.
2. Ensure the container has the TLS runtime deps (ca-certificates, openssl libs) installed.
3. Try building the client without the custom CA to isolate whether TLS config is the trigger.
4. Update/verify the RisingWave build's TLS feature setup if reproducing locally.

Example fix

// before: invalid cert -> build fails
let mut builder = reqwest::Client::builder();
builder = builder.add_root_certificate(Certificate::from_pem(&bad_pem)?);
// after: validate PEM before adding
let cert = reqwest::Certificate::from_pem(&pem).expect("valid PEM cert");
let client = reqwest::Client::builder().add_root_certificate(cert).build()?;

match build_client(conn) {
    Ok(c) => c,
    Err(SchemaRegistryClientError::Build(e)) => {
        eprintln!("reqwest client build failed: {}", e); return Err(e.into());
    }
    Err(e) => return Err(e.into()),
}

When it happens

Trigger: Client construction via TryFrom<&ConfluentSchemaRegistryConnection> when the final reqwest ClientBuilder::build() call errors, e.g. invalid TLS configuration after adding the CA cert, or the TLS backend cannot be initialized in the environment.

Common situations: Corrupt or incompatible CA cert combined with the TLS backend, missing OpenSSL/rustls system dependencies in the container, or conflicting TLS options.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• read ca file error: {0}
• request error
• No private key found
• could not load platform certs
• bad ssl root cert error: {}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/4530edba746554de. Report an issue: GitHub.