cloudflare / cloudflare/cloudflared

Misleading error when cert.pem permissions are incorrect

Open
#680 9 comments 1 reaction 1 assignee Claimed by @abelinkinbio View on GitHub
Type: Discussion
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
`cloudflared` seems to overlook a `cert.pem` that exists but is not readable when seeking `originCertPath`.

**To Reproduce**
1. ```
$ docker run --rm -it -v $(pwd)/.cloudflared:/etc/cloudflared cloudflare/cloudflared tunnel create foo
2022-06-29T01:55:37Z INF Cannot determine default origin certificate path. No file cert.pem in [~/.cloudflared ~/.cloudflare-warp ~/cloudflare-warp /etc/cloudflared /usr/local/etc/cloudflared] originCertPath=
2022-06-29T01:55:37Z ERR You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See https://developers.cloudflare.com/argo-tunnel/reference/arguments/ for more information. originCertPath=
failed to create tunnel: couldn't create client to talk to Cloudflare Tunnel backend: Error locating origin cert: client didn't specify origincert path when running from terminal
```
2. ??? the file is definitely there
```
$ ls -l ./.cloudflared/
total 0
-rw------- 1 wolf wolf 0 Jun 28 18:55 cert.pem
```
3. ...lots more confusion...
4. Maybe if we give the path directly?
```
$ docker run --rm -it -v $(pwd)/.cloudflared:/etc/cloudflared cloudflare/cloudflared --origincert /etc/cloudflared/cert.pem tunnel create foo
2022-06-29T01:57:05Z ERR Cannot check if origin cert exists at path /etc/cloudflared/cert.pem error="open /etc/cloudflared/cert.pem: permission denied" originCertPath=/etc/cloudflared/cert.pem
failed to create tunnel: couldn't create client to talk to Cloudflare Tunnel backend: Error locating origin cert: cannot check if origin cert exists at path /etc/cloudflared/cert.pem
```
5. Oh.
```sh
sudo chown 65532:65532 -R .cloudflared/
```

**Expected behavior**
```
$ docker run --rm -it -v $(pwd)/.cloudflared:/etc/cloudflared cloudflare/cloudflared tunnel create foo
2022-06-29T01:55:37Z ERR Could not read origin cert at path /etc/cloudflared/cert.pem error="open /etc/cloudflared/cert.pem: permission denied" originCertPath=/etc/cloudflared/cert.pem
```
(I suppose you *could* have a situation where there’s an unreadable file earlier in the search path, and the one you actually want comes later. But that seems like a situation where an explicit `--origincert` is a good idea anyway to avoid confusion.)

**Environment and versions**
- OS: Linux + Docker
- Architecture: x86_64
- Version: 2022.6.3 (ae790c4df3bc)

**Logs and errors**
See above.

**Additional context**
This happened because I shuffled some files around midway through setting up the tunnel, and accidentally dropped some permissions in the process. But that could have been a 5-second problem instead of a 5-minute one if I hadn't spent a bunch of time thinking the file had somehow disappeared from the container's filesystem.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.