risingwavelabs/risingwave · warning · PsqlError

Failed to add native CA certificate

Error message

Failed to add native CA certificate

What it means

When no custom ca_cert is configured, pgwire loads the platform's native root certificates via `rustls_native_certs::load_native_certs()` and adds them to the root store; adding one of these native certs failed. Note the loader itself uses `.expect("could not load platform certs")`, so this error specifically covers per-certificate insertion failures.

Source

Thrown at src/utils/pgwire/src/ldap_auth.rs:119

                let cert = cert.map_err(|e| {
                    PsqlError::StartupError(
                        anyhow!(e).context("Failed to parse CA certificate").into(),
                    )
                })?;
                root_cert_store.add(cert).map_err(|err| {
                    PsqlError::StartupError(
                        anyhow!(err).context("Failed to add CA certificate").into(),
                    )
                })?;
            }
        } else {
            // If ca certs is not present, load system native certs.
            for cert in
                rustls_native_certs::load_native_certs().expect("could not load platform certs")
            {
                root_cert_store.add(cert).map_err(|err| {
                    PsqlError::StartupError(
                        anyhow!(err)
                            .context("Failed to add native CA certificate")
                            .into(),
                    )
                })?;
            }
        }
        let tls_client_config = tls_client_config.with_root_certificates(root_cert_store);

        if let Some(cert) = &self.cert {
            let Some(key) = &self.key else {
                return Err(PsqlError::StartupError(
                    "Client certificate provided without private key".into(),
                ));
            };
            let client_cert_bytes = fs::read(cert).map_err(|e| {
                PsqlError::StartupError(
                    anyhow!(e)
                        .context("Failed to read client certificate")

View on GitHub (pinned to 6469eb736d)

Solutions

1. Identify the offending system certificate and remove/update it from the OS trust store.
2. Update the ca-certificates package / base image so the system bundle is valid.
3. Bypass native certs by explicitly configuring a known-good ca_cert file.
4. Read the inner rustls error from the context to see which native cert was rejected.

Example fix

// before: relying on minimal image's cert store
// (no ca_cert set)
// after: explicit CA bundle
ca_cert = "/etc/ssl/certs/ca-certificates.crt"

match err {
    PsqlError::StartupError(e) if e.to_string().contains("Failed to add native CA certificate") => {
        eprintln!("bad system cert store; configure explicit ca_cert: {}", e);
    }
    other => return Err(other),
}

When it happens

Trigger: `init_client_config` with no `ca_cert` set: `root_cert_store.add(cert)` fails for one of the certs returned by `load_native_certs()` — typically a system certificate store entry that rustls cannot accept as a trust anchor.

Common situations: Minimal container images with odd/partial system CA bundles; distro cert stores containing legacy or malformed certificates; unusual OS certificate locations.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to add CA certificate
• Failed to read CA certificate
• Failed to parse CA certificate
• Failed to read client certificate
• Failed to parse client certificate

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/6c96ebd55ac72809. Report an issue: GitHub.