temporalio/temporal · error

invalid ClientTLS.RootCAFiles: %w

Error message

invalid ClientTLS.RootCAFiles: %w

What it means

Error "invalid ClientTLS.RootCAFiles: %w" thrown in temporalio/temporal.

Source

Thrown at common/rpc/encryption/tls_factory.go:141

	}
	if err := validateCAs(cfg.ClientCAData); err != nil {
		return fmt.Errorf("invalid ServerTLS.ClientCAData: %w", err)
	}
	if err := validateCAs(cfg.ClientCAFiles); err != nil {
		return fmt.Errorf("invalid ServerTLS.ClientCAFiles: %w", err)
	}
	if len(cfg.ClientCAFiles) > 0 && len(cfg.ClientCAData) > 0 {
		return fmt.Errorf("cannot specify ClientCAFiles and ClientCAData at the same time")
	}
	return nil
}

func validateClientTLS(cfg *config.ClientTLS) error {
	if err := validateCAs(cfg.RootCAData); err != nil {
		return fmt.Errorf("invalid ClientTLS.RootCAData: %w", err)
	}
	if err := validateCAs(cfg.RootCAFiles); err != nil {
		return fmt.Errorf("invalid ClientTLS.RootCAFiles: %w", err)
	}
	if len(cfg.RootCAData) > 0 && len(cfg.RootCAFiles) > 0 {
		return fmt.Errorf("cannot specify RootCAFiles and RootCAData at the same time")
	}
	return nil
}

func validateCAs(cas []string) error {
	for _, ca := range cas {
		if strings.TrimSpace(ca) == "" {
			return fmt.Errorf("CA cannot be empty string")
		}
	}
	return nil
}

View on GitHub (pinned to bde624efd1)

When it happens

Trigger: Thrown at common/rpc/encryption/tls_factory.go:141 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/2aa6b3dcfe711451. Report an issue: GitHub.