router-for-me/CLIProxyAPI · error

home tls: ca-cert contains no PEM certificates

Error message

home tls: ca-cert contains no PEM certificates

What it means

Returned in internal/home/client.go when the ca-cert file was read successfully but certPool.AppendCertsFromPEM returned false — the file contains no parseable PEM certificates. The system pool fallback is irrelevant here; the configured CA file itself must contribute at least one certificate.

Source

Thrown at internal/home/client.go:661

		tlsConfig.Certificates = []tls.Certificate{certPair}
	}

	caCertPath := strings.TrimSpace(cfg.CACert)
	if caCertPath == "" {
		return tlsConfig, nil
	}

	caCertPEM, errRead := os.ReadFile(caCertPath)
	if errRead != nil {
		return nil, fmt.Errorf("home tls: read ca-cert: %w", errRead)
	}

	certPool, errPool := x509.SystemCertPool()
	if errPool != nil || certPool == nil {
		certPool = x509.NewCertPool()
	}
	if !certPool.AppendCertsFromPEM(caCertPEM) {
		return nil, fmt.Errorf("home tls: ca-cert contains no PEM certificates")
	}
	tlsConfig.RootCAs = certPool

	return tlsConfig, nil
}

func (c *Client) commandClient() (*redis.Client, error) {
	if c == nil || c.dispatchFenced.Load() {
		return nil, ErrDispatchFenced
	}
	if errEnsure := c.ensureClients(); errEnsure != nil {
		return nil, errEnsure
	}
	c.mu.Lock()
	defer c.mu.Unlock()
	if c.dispatchFenced.Load() {
		return nil, ErrDispatchFenced
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Check file content: openssl x509 -in ca.pem -noout must succeed
2. If empty, re-distribute the CA from the home server or fix the secret mount
3. If DER, convert: openssl x509 -in ca.der -inform DER -out ca.pem

Example fix

# verify
openssl x509 -in /etc/cliproxy/ca.pem -noout || echo "bad PEM"

# DER -> PEM if needed
openssl x509 -in /etc/cliproxy/ca.cer -inform DER -out /etc/cliproxy/ca.pem

pemBytes, err := os.ReadFile(cfg.TLS.CACert)
if err != nil { return err }
if !x509.NewCertPool().AppendCertsFromPEM(pemBytes) {
    return fmt.Errorf("home ca-cert %s contains no PEM certificates", cfg.TLS.CACert)
}

When it happens

Trigger: ca-cert file is empty, truncated, or contains keys/other data but no CERTIFICATE blocks; PEM headers corrupted (missing dashes, embedded whitespace from copy-paste); file is in DER format.

Common situations: Secret mounted as an empty file (Kubernetes optional secret missing); CA fetched via a pipeline that HTML-escaped or base64-didn't-decode it; DER .cer saved where PEM expected.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• home ca certificate pem is invalid
• home ca fingerprint is required
• home ca fingerprint mismatch
• client key pem is invalid
• client key pem type %q is unsupported

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/0df76cbb6b43b3d7. Report an issue: GitHub.