What causes "requested workflow history does not exist" in temporalio/temporal?

Pick one source: clear RootCAFiles if using RootCAData, or vice versa.

requested workflow history does not exist

Error message

requested workflow history does not exist

What it means

ClientTLS accepts root CAs either as inline data (RootCAData) or as file paths (RootCAFiles), never both. When both lists are non-empty the TLS loading logic cannot decide which pool to build, so validateClientTLS rejects the config.

Source

Thrown at common/archiver/constants.go:39

	// ErrReasonHistoryMutated is the error reason for mutated history
	ErrReasonHistoryMutated = "history was mutated"
)

var (
	// ErrInvalidURI is the error for invalid URI
	ErrInvalidURI = errors.New("URI is invalid")
	// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver
	ErrURISchemeMismatch = errors.New("URI scheme does not match the archiver")
	// ErrHistoryMutated is the error for mutated history
	ErrHistoryMutated = errors.New("history was mutated")
	// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request
	ErrInvalidGetHistoryRequest = errors.New("get archived history request is invalid")
	// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request
	ErrInvalidQueryVisibilityRequest = errors.New("query visiblity request is invalid")
	// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token
	ErrNextPageTokenCorrupted = errors.New("next page token is corrupted")
	// ErrHistoryNotExist is the error for non-exist history
	ErrHistoryNotExist = errors.New("requested workflow history does not exist")
)

View on GitHub (pinned to bde624efd1)

Solutions

Pick one source: clear RootCAFiles if using RootCAData, or vice versa.
Prefer RootCAData in container deployments to avoid file mounts.
Audit config layering/merging so only one mechanism is populated.
Add a CI lint rule enforcing File/Data mutual exclusivity across TLS configs.

Example fix

// before
ClientTLS:
  RootCAFiles: [/etc/temporal/ca.pem]
  RootCAData: ["-----BEGIN CERTIFICATE-----..."]
// after
ClientTLS:
  RootCAData: ["-----BEGIN CERTIFICATE-----..."]

Defensive patterns

Strategy: validation

Validate before calling

if len(cfg.RootCAData) > 0 && len(cfg.RootCAFiles) > 0 {
	return fmt.Errorf("choose either RootCAFiles or RootCAData, not both")
}

Prevention

Document one canonical CA-source style per deployment environment.
When converting file-based configs to inline data, delete the file entries in the same change.
Add CI validation mirroring validateClientTLS before rollout.

When it happens

Trigger: Calling validateGroupTLS or validateWorkerTLS where both ClientTLS.RootCAData and ClientTLS.RootCAFiles are non-empty.

Common situations: Upgrading configs from file-based to inline secrets while leaving old file paths; shared client config snippet copied into a per-service config that also sets files; automation appending CA data without clearing files.

Related errors

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/a3508298a964e1ac. Report an issue: GitHub.