From 9738f49b952a337cdaf42175a0e92b01974c0e3c Mon Sep 17 00:00:00 2001 From: Herman Slatman Date: Mon, 20 Jul 2026 05:59:46 +0200 Subject: [PATCH] pki: Handle error immediately after reading root from disk (#7896) In https://github.com/caddyserver/caddy/pull/7057, the behavior of `KeyPair.Load` was changed to return a certificate chain. While the change was primarily meant for intermediates, it also affected how a root (or roots) were loaded. The existing error handling logic relied on a shared `err != nil` check, but with the new behavior there's no guarantee that there's actually a root in the PEM file on disk. This commit handles the error immediately after reading the PEM from disk. Fixes: #7895 --- modules/caddypki/ca.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/caddypki/ca.go b/modules/caddypki/ca.go index 4b98244aa..b7befda1e 100644 --- a/modules/caddypki/ca.go +++ b/modules/caddypki/ca.go @@ -152,6 +152,9 @@ func (ca *CA) Provision(ctx caddy.Context, id string, log *zap.Logger) error { ca.rootCertPath = ca.Root.Certificate } rootCertChain, rootKey, err = ca.Root.Load() + if err != nil { + return err + } rootCert = rootCertChain[0] } else { ca.rootCertPath = "storage:" + ca.storageKeyRootCert()