zeroclaw-labs/zeroclaw · error · anyhow::Error

MCP server ` `: TLS CA certificate at ` ` exceeds the -byte…

Error message

MCP server `{}`: TLS CA certificate at `{path}` exceeds the {MAX_TLS_CA_BYTES}-byte limit

What it means

Size guard in load_tls_ca_pem, which reads a custom CA certificate for an MCP server's remote HTTP transport (called when building the remote HTTP client). It fires when the file at the configured CA path is a regular file but its byte length exceeds MAX_TLS_CA_BYTES. An oversized 'certificate' almost always means the path points to the wrong file (a bundle dump, keychain export, or binary) rather than a valid PEM CA certificate. Point the config at a single PEM-encoded CA certificate within the size limit.

Solutions

1. Use a smaller CA certificate bundle within the byte limit.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:143 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/bacbe5943799bac3. Report an issue: GitHub.

Appendix: source

Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:143

        format!(
            "MCP server `{}`: cannot read TLS CA certificate at `{path}`",
            config.name
        )
    })?;
    let opened_metadata = file.metadata().with_context(|| {
        format!(
            "MCP server `{}`: cannot inspect opened TLS CA certificate at `{path}`",
            config.name
        )
    })?;
    if !opened_metadata.file_type().is_file() {
        bail!(
            "MCP server `{}`: TLS CA certificate path must name a regular file: `{path}`",
            config.name
        );
    }
    if opened_metadata.len() > MAX_TLS_CA_BYTES as u64 {
        bail!(
            "MCP server `{}`: TLS CA certificate at `{path}` exceeds the {MAX_TLS_CA_BYTES}-byte limit",
            config.name
        );
    }

    let mut pem = Vec::with_capacity(opened_metadata.len() as usize + 1);
    file.take(MAX_TLS_CA_BYTES as u64 + 1)
        .read_to_end(&mut pem)
        .with_context(|| {
            format!(
                "MCP server `{}`: cannot read TLS CA certificate at `{path}`",
                config.name
            )
        })?;
    if pem.len() > MAX_TLS_CA_BYTES {
        bail!(
            "MCP server `{}`: TLS CA certificate at `{path}` exceeds the {MAX_TLS_CA_BYTES}-byte limit",
            config.name

View on GitHub (pinned to 88bb9c8533)