yudai/gotty · error

could not parse CA crt file data in %s

Error message

could not parse CA crt file data in %s

What it means

After successfully reading the CA file, tlsConfig() feeds the bytes to x509.AppendCertsFromPEM. If no certificate could be parsed from the data, this error is returned with the file path. The file exists but its contents are not a valid PEM-encoded certificate.

Source

Thrown at server/server.go:239

		tlsConfig, err := server.tlsConfig()
		if err != nil {
			return nil, errors.Wrapf(err, "failed to setup TLS configuration")
		}
		srv.TLSConfig = tlsConfig
	}

	return srv, nil
}

func (server *Server) tlsConfig() (*tls.Config, error) {
	caFile := homedir.Expand(server.options.TLSCACrtFile)
	caCert, err := ioutil.ReadFile(caFile)
	if err != nil {
		return nil, errors.New("could not open CA crt file " + caFile)
	}
	caCertPool := x509.NewCertPool()
	if !caCertPool.AppendCertsFromPEM(caCert) {
		return nil, errors.New("could not parse CA crt file data in " + caFile)
	}
	tlsConfig := &tls.Config{
		ClientCAs:  caCertPool,
		ClientAuth: tls.RequireAndVerifyClientCert,
	}
	return tlsConfig, nil
}

View on GitHub (pinned to a080c85cbc)

Solutions

1. Verify the file is PEM: it should start with -----BEGIN CERTIFICATE-----
2. Convert DER to PEM if needed: openssl x509 -inform DER -in ca.der -out ca.crt
3. Re-download/re-copy the CA certificate and check with openssl x509 -in ca.crt -noout -text
4. Ensure you are not pointing at the private key or a chain of unrelated certs

Example fix

// before
tls_ca_crt_file = "/etc/ssl/private/ca.key"
// after
tls_ca_crt_file = "/etc/gotty/pki/ca.crt"

pemBytes, _ := os.ReadFile(caPath)
if block, _ := pem.Decode(pemBytes); block == nil || block.Type != "CERTIFICATE" {
    log.Fatalf("%s is not a PEM certificate", caPath)
}
if _, err := x509.ParseCertificate(block.Bytes); err != nil {
    log.Fatalf("CA cert unparseable: %v", err)
}

if err := srv.Run(ctx); err != nil {
    if strings.Contains(err.Error(), "could not parse CA crt file data") {
        log.Fatalf("Bad CA PEM data: %v", err)
    }
}

When it happens

Trigger: TLSCACrtFile contains a private key, a DER (binary) certificate, concatenated garbage, an empty file, or text PEM without CERTIFICATE blocks.

Common situations: Pointing at the server key instead of the CA cert; copying a cert through a transfer that mangled it; an empty placeholder file created by a deployment script.

Related errors

• failed to setup an HTTP server
• failed to setup TLS configuration
• could not open CA crt file %s

AI-assisted analysis of yudai/gotty@a080c85cbc (2026-09-02). Data as JSON: /api/errors/b8f196a8ff85726b. Report an issue: GitHub.