XTLS/Xray-core · error

failed to parse parent certificate

Error message

failed to parse parent certificate

What it means

Error "failed to parse parent certificate" thrown in XTLS/Xray-core.

Source

Thrown at common/protocol/tls/cert/cert.go:155

	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, errors.New("failed to generate serial number").Base(err)
	}

	template := &x509.Certificate{
		SerialNumber:          serialNumber,
		NotBefore:             time.Now().Add(time.Hour * -1),
		NotAfter:              time.Now().Add(time.Hour),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}

	parentCert := template
	if parent != nil {
		pCert, err := x509.ParseCertificate(parent.Certificate)
		if err != nil {
			return nil, errors.New("failed to parse parent certificate").Base(err)
		}
		parentCert = pCert
	}

	if parentCert.NotAfter.Before(template.NotAfter) {
		template.NotAfter = parentCert.NotAfter
	}
	if parentCert.NotBefore.After(template.NotBefore) {
		template.NotBefore = parentCert.NotBefore
	}

	for _, opt := range opts {
		opt(template)
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, template, parentCert, publicKey(selfKey), parentKey)
	if err != nil {
		return nil, errors.New("failed to create certificate").Base(err)

View on GitHub (pinned to 7d214f8b09)

When it happens

Trigger: Thrown at common/protocol/tls/cert/cert.go:155 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/efcff77c5e564573. Report an issue: GitHub.