risingwavelabs/risingwave · critical

could not load platform certs

Error message

could not load platform certs

What it means

When building the MQTT TLS client without an explicit CA certificate, get_tls_config loads the operating system's native root certificates via rustls_native_certs::load_native_certs() and panics (expect) if that fails. This means the platform certificate store could not be read, so TLS trust anchors would be unavailable.

Source

Thrown at src/connector/src/connector_common/mqtt_common.rs:171

            .as_ref()
            .map(|qos| match qos {
                QualityOfService::AtMostOnce => QoS::AtMostOnce,
                QualityOfService::AtLeastOnce => QoS::AtLeastOnce,
                QualityOfService::ExactlyOnce => QoS::ExactlyOnce,
            })
            .unwrap_or(QoS::AtMostOnce)
    }

    fn get_tls_config(&self) -> ConnectorResult<rustls::ClientConfig> {
        let mut root_cert_store = rustls::RootCertStore::empty();
        if let Some(ca) = &self.ca {
            let certificates = load_certs(ca)?;
            for cert in certificates {
                root_cert_store.add(cert).unwrap();
            }
        } else {
            for cert in
                rustls_native_certs::load_native_certs().expect("could not load platform certs")
            {
                root_cert_store.add(cert).unwrap();
            }
        }

        let builder = rustls::ClientConfig::builder().with_root_certificates(root_cert_store);

        let tls_config = if let (Some(client_cert), Some(client_key)) =
            (self.client_cert.as_ref(), self.client_key.as_ref())
        {
            let certs = load_certs(client_cert)?;
            let key = load_private_key(client_key)?;

            builder.with_client_auth_cert(certs, key)?
        } else {
            builder.with_no_client_auth()
        };

View on GitHub (pinned to 6469eb736d)

Solutions

1. Configure an explicit CA certificate file for the MQTT source (the `ca` option) so native cert loading is skipped.
2. Install OS CA certificates in the container/host (e.g. `apt-get install ca-certificates` or `apk add ca-certificates`).
3. Check and unset/fix SSL_CERT_FILE and SSL_CERT_DIR environment variables if they point to invalid paths.
4. Reproduce rustls_native_certs::load_native_certs() standalone to see the exact underlying error.

Example fix

// before: TLS enabled, no CA configured on a slim image
// after: provide explicit CA file
CREATE SOURCE ... WITH (
  connector = 'mqtt',
  tls.mode = 'enable',
  ca = '/etc/ssl/certs/ca-certificates.crt'
);

// ensure platform certs exist before relying on native store
let has_native = std::path::Path::new("/etc/ssl/certs/ca-certificates.crt").exists()
    || std::env::var_os("SSL_CERT_FILE").map(|p| std::path::Path::new(&p).exists()).unwrap_or(false);
if !has_native {
    return Err("no platform certs; configure the connector 'ca' option");
}

// avoid the expect by falling back to a bundled/explicit CA
match rustls_native_certs::load_native_certs() {
    Ok(certs) if !certs.is_empty() => certs,
    _ => load_certs(std::path::Path::new("/etc/ssl/certs/ca-certificates.crt"))
        .expect("no native or fallback CA available"),
}

When it happens

Trigger: build_client with TLS enabled and no `ca` file configured, on systems where the native cert store is missing/unreadable: no /etc/ssl/certs or equivalent, empty SSL_CERT_FILE/SSL_CERT_DIR pointing at bad locations, stripped-down container images without ca-certificates.

Common situations: Running in minimal Docker/scratch images lacking the ca-certificates package; SSL_CERT_FILE env var set to a nonexistent path; Windows/macOS cert store access failures; Alpine images without the ca-certificates-bundle.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• failed to convert JSON schema to Avro schema: {}
• failed to parse static creds
• No private key found
• not yet implemented
• bad ssl root cert error: {}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/d6a8bf62a8a958cc. Report an issue: GitHub.