zeroclaw-labs/zeroclaw · error · anyhow::Error

MCP server `{}`: TLS CA certificate path must be absolute: `

Error message

MCP server `{}`: TLS CA certificate path must be absolute: `{}`

What it means

Error "MCP server `{}`: TLS CA certificate path must be absolute: `{}`" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:191

    if let Some(path) = config.tls_ca_cert_path.as_deref() {
        let server_name = config.name.clone();
        builder = builder.redirect(reqwest::redirect::Policy::custom(move |attempt| {
            if attempt.previous().len() >= 10 {
                attempt.error(std::io::Error::other(format!(
                    "MCP server `{server_name}`: too many redirects"
                )))
            } else if attempt.url().scheme() == "https" {
                attempt.follow()
            } else {
                attempt.error(std::io::Error::other(format!(
                    "MCP server `{server_name}`: tls_ca_cert_path forbids redirecting to plaintext"
                )))
            }
        }));

        if !std::path::Path::new(path).is_absolute() {
            bail!(
                "MCP server `{}`: TLS CA certificate path must be absolute: `{}`",
                config.name,
                path
            );
        }

        let pem = load_tls_ca_pem(config, path)?;
        let certificates = reqwest::Certificate::from_pem_bundle(&pem).with_context(|| {
            format!(
                "MCP server `{}`: invalid PEM CA certificate at `{}`",
                config.name, path
            )
        })?;
        if certificates.is_empty() {
            bail!(
                "MCP server `{}`: CA certificate file `{}` contained no certificates",
                config.name,
                path

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Use an absolute path for the MCP server's TLS CA certificate.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:191 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/4b3996401d7bcb3c. Report an issue: GitHub.