What causes "URI scheme does not match the archiver" in temporalio/temporal?

Inspect ClientCAData and remove empty/whitespace entries from the list.

URI scheme does not match the archiver

Error message

URI scheme does not match the archiver

What it means

This is a wrapping error: validateCAs failed while parsing the ServerTLS.ClientCAData entries (PEM blobs of CAs used to verify mTLS clients). The %w carries the underlying reason from validateCAs, most commonly an empty string in the ClientCAData list.

Source

Thrown at common/archiver/constants.go:29

	ArchiveTransientErrorMsg = "Archive method encountered a transient error."
	// ArchiveSkippedInfoMsg is the log messsage when the Archive() method encounter an not found error
	ArchiveSkippedInfoMsg = "Archive method encountered not found error and skipped the archival"

	// ErrReasonInvalidURI is the error reason for invalid URI
	ErrReasonInvalidURI = "URI is invalid"
	// ErrReasonInvalidArchiveRequest is the error reason for invalid archive request
	ErrReasonInvalidArchiveRequest = "archive request is invalid"
	// ErrReasonReadHistory is the error reason for failing to read history
	ErrReasonReadHistory = "failed to read history batches"
	// ErrReasonHistoryMutated is the error reason for mutated history
	ErrReasonHistoryMutated = "history was mutated"
)

var (
	// ErrInvalidURI is the error for invalid URI
	ErrInvalidURI = errors.New("URI is invalid")
	// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver
	ErrURISchemeMismatch = errors.New("URI scheme does not match the archiver")
	// ErrHistoryMutated is the error for mutated history
	ErrHistoryMutated = errors.New("history was mutated")
	// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request
	ErrInvalidGetHistoryRequest = errors.New("get archived history request is invalid")
	// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request
	ErrInvalidQueryVisibilityRequest = errors.New("query visiblity request is invalid")
	// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token
	ErrNextPageTokenCorrupted = errors.New("next page token is corrupted")
	// ErrHistoryNotExist is the error for non-exist history
	ErrHistoryNotExist = errors.New("requested workflow history does not exist")
)

View on GitHub (pinned to bde624efd1)

Solutions

Inspect ClientCAData and remove empty/whitespace entries from the list.
Fix the env-var or template substitution that produced the blank entry.
If using file-based CAs instead, move the entries to ClientCAFiles and clear ClientCAData.
Validate the CA PEM blobs parse before deploying (e.g. openssl x509 -in ca.pem).

Example fix

// before
ClientCAData: ["-----BEGIN CERTIFICATE-----...", ""]
// after
ClientCAData: ["-----BEGIN CERTIFICATE-----..."]

Defensive patterns

Strategy: validation

Validate before calling

for i, ca := range cfg.ClientCAData {
	if strings.TrimSpace(ca) == "" {
		return fmt.Errorf("ClientCAData[%d] is empty", i)
	}
}

Prevention

Render and lint configs before deploy; drop blank list items.
Avoid env-var substitution for CA PEM unless the variable is guaranteed non-empty.
Keep CA data in secrets and verify secret mounts before service start.

When it happens

Trigger: Calling validateGroupTLS/validateServerTLS with ServerTLS.ClientCAData containing an entry that is empty or whitespace-only (validateCAs rejects it).

Common situations: A YAML list with a trailing '-' empty item under client_ca_data; an environment-variable substitution that expanded to nothing; template rendering leaving a blank entry.

Related errors

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/e176e6d43d162a12. Report an issue: GitHub.