cloudflare / cloudflare/cloudflared
Misleading error when cert.pem permissions are incorrect
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
`cloudflared` seems to overlook a `cert.pem` that exists but is not readable when seeking `originCertPath`.
**To Reproduce**
1. ```
$ docker run --rm -it -v $(pwd)/.cloudflared:/etc/cloudflared cloudflare/cloudflared tunnel create foo
2022-06-29T01:55:37Z INF Cannot determine default origin certificate path. No file cert.pem in [~/.cloudflared ~/.cloudflare-warp ~/cloudflare-warp /etc/cloudflared /usr/local/etc/cloudflared] originCertPath=
2022-06-29T01:55:37Z ERR You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See https://developers.cloudflare.com/argo-tunnel/reference/arguments/ for more information. originCertPath=
failed to create tunnel: couldn't create client to talk to Cloudflare Tunnel backend: Error locating origin cert: client didn't specify origincert path when running from terminal
```
2. ??? the file is definitely there
```
$ ls -l ./.cloudflared/
total 0
-rw------- 1 wolf wolf 0 Jun 28 18:55 cert.pem
```
3. ...lots more confusion...
4. Maybe if we give the path directly?
```
$ docker run --rm -it -v $(pwd)/.cloudflared:/etc/cloudflared cloudflare/cloudflared --origincert /etc/cloudflared/cert.pem tunnel create foo
2022-06-29T01:57:05Z ERR Cannot check if origin cert exists at path /etc/cloudflared/cert.pem error="open /etc/cloudflared/cert.pem: permission denied" originCertPath=/etc/cloudflared/cert.pem
failed to create tunnel: couldn't create client to talk to Cloudflare Tunnel backend: Error locating origin cert: cannot check if origin cert exists at path /etc/cloudflared/cert.pem
```
5. Oh.
```sh
sudo chown 65532:65532 -R .cloudflared/
```
**Expected behavior**
```
$ docker run --rm -it -v $(pwd)/.cloudflared:/etc/cloudflared cloudflare/cloudflared tunnel create foo
2022-06-29T01:55:37Z ERR Could not read origin cert at path /etc/cloudflared/cert.pem error="open /etc/cloudflared/cert.pem: permission denied" originCertPath=/etc/cloudflared/cert.pem
```
(I suppose you *could* have a situation where there’s an unreadable file earlier in the search path, and the one you actually want comes later. But that seems like a situation where an explicit `--origincert` is a good idea anyway to avoid confusion.)
**Environment and versions**
- OS: Linux + Docker
- Architecture: x86_64
- Version: 2022.6.3 (ae790c4df3bc)
**Logs and errors**
See above.
**Additional context**
This happened because I shuffled some files around midway through setting up the tunnel, and accidentally dropped some permissions in the process. But that could have been a 5-second problem instead of a 5-minute one if I hadn't spent a bunch of time thinking the file had somehow disappeared from the container's filesystem.
Contributor guide
Assessment
This issue has not been assessed yet.