What causes "amqps:// requires ca_cert to verify the broker" in zeroclaw-labs/zeroclaw?

Set `ca_cert` to the PEM bundle that signed the broker certificate, e.g. `ca_cert = "/etc/zeroclaw/ca.pem"`.

amqps:// requires ca_cert to verify the broker

Error message

amqps:// requires ca_cert to verify the broker

What it means

For `amqps://` connections the AMQP consumer must verify the broker against a CA certificate; ZeroClaw treats an unverified TLS connection as a misconfiguration rather than silently skipping verification. The validator therefore requires the `ca_cert` path to be set whenever the URL scheme is `amqps://`.

Source

Thrown at crates/zeroclaw-config/src/schema.rs:16614

    /// Checks:
    /// - `amqp_url` uses a valid scheme (`amqp://` or `amqps://`)
    /// - `amqps://` connections carry a CA certificate
    /// - `client_cert` and `client_key` are supplied together (mutual TLS)
    /// - the exchange is non-empty
    /// - at least one routing key is bound
    pub fn validate(&self) -> anyhow::Result<()> {
        let is_tls = self.amqp_url.starts_with("amqps://");
        let is_plain = self.amqp_url.starts_with("amqp://");

        if !is_tls && !is_plain {
            anyhow::bail!(
                "amqp_url must start with 'amqp://' or 'amqps://', got: {}",
                self.amqp_url
            );
        }

        if is_tls && self.ca_cert.is_none() {
            anyhow::bail!("amqps:// requires ca_cert to verify the broker");
        }

        match (self.client_cert.is_some(), self.client_key.is_some()) {
            (true, false) => {
                anyhow::bail!(
                    "client_cert is set but client_key is missing (both are required for mutual TLS)"
                )
            }
            (false, true) => {
                anyhow::bail!(
                    "client_key is set but client_cert is missing (both are required for mutual TLS)"
                )
            }
            _ => {}
        }

        if self.exchange.is_empty() {
            validation_bail!(RequiredFieldEmpty, "exchange", "exchange must not be empty");

View on GitHub (pinned to 88bb9c8533)

Solutions

Set `ca_cert` to the PEM bundle that signed the broker certificate, e.g. `ca_cert = "/etc/zeroclaw/ca.pem"`.
For Fedora Messaging, use the CA provided by the project (e.g. `fedora-messaging` CA) at its documented path.
If TLS is not actually required, fall back to `amqp://` on port 5672.

Example fix

# before
amqp_url = "amqps://broker.example.com:5671/zeroclaw"
# no ca_cert

# after
amqp_url = "amqps://broker.example.com:5671/zeroclaw"
ca_cert = "/etc/zeroclaw/ca.pem"

Defensive patterns

Strategy: validation

Validate before calling

anyhow::ensure!(
    !cfg.amqp_url.starts_with("amqps://") || cfg.ca_cert.is_some(),
    "amqps:// requires an explicit ca_cert path"
);

Prevention

Whenever you switch the scheme to amqps://, add ca_cert in the same edit.
ZeroClaw does not fall back to the system trust store — the path must be explicit.
Keep the CA bundle versioned alongside the config.

When it happens

Trigger: `amqp_url = "amqps://broker.example.com:5671/zeroclaw"` with no `ca_cert` key; upgrading a URL from `amqp://` to `amqps://` and forgetting the trust anchor; assuming the system trust store is used implicitly (it is not — an explicit path is required).

Common situations: Onboarding to Fedora Messaging or a corporate RabbitMQ over TLS; copying an mTLS example that omits the CA line; the CA existing on disk but never being referenced in config.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/77c796c65f49f02a. Report an issue: GitHub.