temporalio/temporal · error

invalid ServerTLS.ClientCAData: %w

Error message

invalid ServerTLS.ClientCAData: %w

What it means

Error "invalid ServerTLS.ClientCAData: %w" thrown in temporalio/temporal.

Source

Thrown at common/rpc/encryption/tls_factory.go:125

func validateWorkerTLS(cfg *config.WorkerTLS) error {
	if cfg.CertFile != "" && cfg.CertData != "" {
		return fmt.Errorf("cannot specify CertFile and CertData at the same time")
	}
	if cfg.KeyFile != "" && cfg.KeyData != "" {
		return fmt.Errorf("cannot specify KeyFile and KeyData at the same time")
	}
	return validateClientTLS(&cfg.Client)
}

func validateServerTLS(cfg *config.ServerTLS) error {
	if cfg.CertFile != "" && cfg.CertData != "" {
		return fmt.Errorf("cannot specify CertFile and CertData at the same time")
	}
	if cfg.KeyFile != "" && cfg.KeyData != "" {
		return fmt.Errorf("cannot specify KeyFile and KeyData at the same time")
	}
	if err := validateCAs(cfg.ClientCAData); err != nil {
		return fmt.Errorf("invalid ServerTLS.ClientCAData: %w", err)
	}
	if err := validateCAs(cfg.ClientCAFiles); err != nil {
		return fmt.Errorf("invalid ServerTLS.ClientCAFiles: %w", err)
	}
	if len(cfg.ClientCAFiles) > 0 && len(cfg.ClientCAData) > 0 {
		return fmt.Errorf("cannot specify ClientCAFiles and ClientCAData at the same time")
	}
	return nil
}

func validateClientTLS(cfg *config.ClientTLS) error {
	if err := validateCAs(cfg.RootCAData); err != nil {
		return fmt.Errorf("invalid ClientTLS.RootCAData: %w", err)
	}
	if err := validateCAs(cfg.RootCAFiles); err != nil {
		return fmt.Errorf("invalid ClientTLS.RootCAFiles: %w", err)
	}
	if len(cfg.RootCAData) > 0 && len(cfg.RootCAFiles) > 0 {

View on GitHub (pinned to bde624efd1)

When it happens

Trigger: Thrown at common/rpc/encryption/tls_factory.go:125 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/8f2966112fb16aaf. Report an issue: GitHub.