siyuan-note/siyuan · error

the provided certificate is not a CA certificate

Error message

the provided certificate is not a CA certificate

What it means

Returned by ImportCABundle when the parsed certificate's IsCA flag is false. The cert parsed correctly but it is a leaf/end-entity certificate (e.g. a server TLS cert), not a CA certificate, so it cannot be installed as the local CA that signs server certs.

Source

Thrown at kernel/util/cert.go:327

	}

	return nil
}

// ImportCABundle imports a CA certificate and private key from PEM-encoded strings.
func ImportCABundle(caCertPEM, caKeyPEM string) error {
	certBlock, _ := pem.Decode([]byte(caCertPEM))
	if certBlock == nil {
		return fmt.Errorf("failed to decode CA certificate PEM")
	}

	caCert, err := x509.ParseCertificate(certBlock.Bytes)
	if err != nil {
		return fmt.Errorf("failed to parse CA certificate: %w", err)
	}

	if !caCert.IsCA {
		return fmt.Errorf("the provided certificate is not a CA certificate")
	}

	keyBlock, _ := pem.Decode([]byte(caKeyPEM))
	if keyBlock == nil {
		return fmt.Errorf("failed to decode CA private key PEM")
	}

	_, err = x509.ParseECPrivateKey(keyBlock.Bytes)
	if err != nil {
		return fmt.Errorf("failed to parse CA private key: %w", err)
	}

	caCertPath := filepath.Join(ConfDir, TLSCACertFilename)
	caKeyPath := filepath.Join(ConfDir, TLSCAKeyFilename)

	if err := os.WriteFile(caCertPath, []byte(caCertPEM), 0644); err != nil {
		return fmt.Errorf("failed to write CA certificate: %w", err)
	}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Provide the CA certificate that issued the server cert, not the server cert itself.
2. Confirm `openssl x509 -in ca.pem -noout -text` shows `CA:TRUE` under Basic Constraints.
3. If you only have a leaf cert, generate a local CA instead (GetOrCreateTLSCert) rather than importing.

Example fix

// before
ImportCABundle(serverCertPEM, keyPEM) // -> not a CA certificate

// after
ImportCABundle(caCertPEM, caKeyPEM) // CA:TRUE, KeyUsageCertSign

// Confirm IsCA before importing.
block, _ := pem.Decode([]byte(caCertPEM))
if block == nil { return errors.New("invalid PEM") }
cert, err := x509.ParseCertificate(block.Bytes)
if err != nil { return err }
if !cert.IsCA {
    return errors.New("provided cert is a leaf, not a CA; supply the issuing CA cert")
}
return util.ImportCABundle(caCertPEM, caKeyPEM)

When it happens

Trigger: Calling ImportCABundle with a server/leaf certificate (BasicConstraints CA:FALSE) instead of a CA certificate.

Common situations: Confusing the server TLS cert with the CA cert; importing a certificate that was issued for TLS server auth but never had CA:TRUE / KeyUsage CertSign.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to parse CA certificate: %w
• failed to decode CA certificate PEM
• failed to decode CA private key PEM
• failed to parse CA private key: %w
• failed to write CA certificate: %w

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/f240dadacbadbca9. Report an issue: GitHub.