temporalio/temporal · error

next page token is corrupted

Error message

next page token is corrupted

What it means

This is a wrapping error from validateClientTLS: validateCAs rejected an entry in ClientTLS.RootCAFiles, the list of root CA bundle file paths. An element is empty or whitespace-only, which validateCAs rejects before any file I/O happens.

Source

Thrown at common/archiver/constants.go:37

	// ErrReasonReadHistory is the error reason for failing to read history
	ErrReasonReadHistory = "failed to read history batches"
	// ErrReasonHistoryMutated is the error reason for mutated history
	ErrReasonHistoryMutated = "history was mutated"
)

var (
	// ErrInvalidURI is the error for invalid URI
	ErrInvalidURI = errors.New("URI is invalid")
	// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver
	ErrURISchemeMismatch = errors.New("URI scheme does not match the archiver")
	// ErrHistoryMutated is the error for mutated history
	ErrHistoryMutated = errors.New("history was mutated")
	// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request
	ErrInvalidGetHistoryRequest = errors.New("get archived history request is invalid")
	// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request
	ErrInvalidQueryVisibilityRequest = errors.New("query visiblity request is invalid")
	// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token
	ErrNextPageTokenCorrupted = errors.New("next page token is corrupted")
	// ErrHistoryNotExist is the error for non-exist history
	ErrHistoryNotExist = errors.New("requested workflow history does not exist")
)

View on GitHub (pinned to bde624efd1)

Solutions

1. Remove the empty string from RootCAFiles.
2. If no custom roots are needed, use an empty list rather than [""].
3. Fix the config generator/template producing the blank path.
4. Confirm each remaining path exists and holds valid PEM CA certificates.

Example fix

// before
ClientTLS:
  RootCAFiles: ["/etc/ssl/certs/ca.pem", ""]
// after
ClientTLS:
  RootCAFiles: ["/etc/ssl/certs/ca.pem"]

for i, f := range cfg.RootCAFiles {
	if strings.TrimSpace(f) == "" {
		return fmt.Errorf("RootCAFiles[%d] is empty", i)
	}
}

When it happens

Trigger: Calling validateGroupTLS or validateWorkerTLS with ClientTLS.RootCAFiles containing an empty string element.

Common situations: Config lists like root_ca_files: ["ca.pem", ""]; scripted config generation appending an empty path; values-file merge artifacts in Kubernetes deployments.

Related errors

• URI scheme does not match the archiver
• history was mutated
• query visiblity request is invalid
• invalid operation token
• URI is invalid

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/c5e04aacef27fdc8. Report an issue: GitHub.