Add user friendly error

Author: mtodor

go.mod

@@ -11,6 +11,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	golang.stackrox.io/grpc-http1 v0.5.1
 	google.golang.org/grpc v1.81.0
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -40,7 +41,6 @@ require (
 	golang.org/x/text v0.35.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

internal/client/client.go

@@ -70,7 +70,9 @@ func (c *Client) Connect(ctx context.Context) error {
 
 	tlsConfig, err := c.tlsConfig()
 	if err != nil {
-		return err
+		slog.Error("TLS configuration failed", "error", err)
+
+		return errors.New("invalid TLS configuration: verify CA certificate configuration, check server logs for details")
 	}
 
 	var conn *grpc.ClientConn

internal/client/client_test.go

@@ -24,6 +24,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 func TestClientReconnectsAfterServerRestart(t *testing.T) {
@@ -313,6 +314,23 @@ func TestClient_tlsConfig_NonexistentCACertPath(t *testing.T) {
 	assert.Contains(t, err.Error(), "failed to access CA certificate")
 }
 
+func TestClient_Connect_SanitizesTLSConfigError(t *testing.T) {
+	client := &Client{
+		config: &config.CentralConfig{
+			URL:        "central.stackrox.io:8443",
+			AuthType:   config.AuthTypeStatic,
+			APIToken:   "dummy",
+			CACertPath: "/nonexistent/secret/path/ca.crt",
+		},
+	}
+
+	err := client.Connect(context.Background())
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "/nonexistent/secret/path/ca.crt")
+	assert.Contains(t, err.Error(), "invalid TLS configuration")
+	assert.Contains(t, err.Error(), "check server logs for details")
+}
+
 // generateTestCert creates a certificate PEM with the given options, signed by the given CA.
 // If ca/caKey are nil, the cert is self-signed.
 func generateTestCert(
@@ -472,7 +490,7 @@ func TestClient_ConnectWithCACert_Positive(t *testing.T) {
 
 	// Invoke a dummy RPC to trigger the TLS handshake. The method doesn't exist,
 	// so the server returns Unimplemented — any non-TLS error proves the handshake succeeded.
-	err = conn.Invoke(ctx, "/test.Service/Method", nil, nil)
+	err = conn.Invoke(ctx, "/test.Service/Method", &emptypb.Empty{}, &emptypb.Empty{})
 	require.Error(t, err)
 
 	// Verify the error is NOT a TLS certificate verification failure.
@@ -514,7 +532,7 @@ func TestClient_ConnectWithoutCACert_Negative(t *testing.T) {
 
 	// Invoke triggers the actual TLS handshake. Because no CA cert is provided and
 	// InsecureSkipTLSVerify is false, the self-signed server cert cannot be verified.
-	err = conn.Invoke(ctx, "/test.Service/Method", nil, nil)
+	err = conn.Invoke(ctx, "/test.Service/Method", &emptypb.Empty{}, &emptypb.Empty{})
 	require.Error(t, err)
 
 	// Verify the error IS a TLS certificate verification failure.