pki: Handle error immediately after reading root from disk (#7896)

In https://github.com/caddyserver/caddy/pull/7057, the behavior of `KeyPair.Load` was changed to return a certificate chain. While the change was primarily meant for intermediates, it also affected how a root (or roots) were loaded. The existing error handling logic relied on a shared `err != nil` check, but with the new behavior there's no guarantee that there's actually a root in the PEM file on disk. This commit handles the error immediately after reading the PEM from disk. Fixes: #7895

Herman Slatman committed Jul 20, 2026 at 05:59 UTC 9738f49b952a337cdaf42175a0e92b01974c0e3c

1 file changed +3

modules/caddypki/ca.go

@@ -152,6 +152,9 @@ func (ca *CA) Provision(ctx caddy.Context, id string, log *zap.Logger) error {

152 ca.rootCertPath = ca.Root.Certificate

153 }

154 rootCertChain, rootKey, err = ca.Root.Load()

155 + if err != nil {

156 + return err

157 + }

158 rootCert = rootCertChain[0]

159 } else {

160 ca.rootCertPath = "storage:" + ca.storageKeyRootCert()