no certificates were found while parsing the bundle

Error message

no certificates were found while parsing the bundle

What it means

Returned by parsePEMBundle after scanning the entire input when zero PEM blocks of type CERTIFICATE were successfully parsed. Either the input is not PEM at all, or all blocks failed x509.ParseCertificate / were of a non-certificate type.

Source

Thrown at common/ocsp/ocsp.go:132

	var certDERBlock *pem.Block

	for {
		certDERBlock, bundle = pem.Decode(bundle)
		if certDERBlock == nil {
			break
		}

		if certDERBlock.Type == "CERTIFICATE" {
			cert, err := x509.ParseCertificate(certDERBlock.Bytes)
			if err != nil {
				return nil, err
			}
			certificates = append(certificates, cert)
		}
	}

	if len(certificates) == 0 {
		return nil, errors.New("no certificates were found while parsing the bundle")
	}

	return certificates, nil
}

View on GitHub (pinned to 7d214f8b09)

Solutions

Check the file starts with '-----BEGIN CERTIFICATE-----' and ends with '-----END CERTIFICATE-----'
If it is DER, convert with openssl: `openssl x509 -inform der -in cert.der -out cert.pem`
Validate with `openssl x509 -in cert.pem -noout` to confirm the file parses on its own

Example fix

# convert DER to PEM
openssl x509 -inform der -in ca.der -out ca.pem

Defensive patterns

Strategy: validation

Validate before calling

if !bytes.HasPrefix(pemBundle, []byte("-----BEGIN")) {
    return errors.New("input is not PEM; convert DER with openssl x509 -inform der")
}

Type guard

func looksLikePEMBundle(b []byte) bool { return bytes.Contains(b, []byte("-----BEGIN CERTIFICATE-----")) }

Prevention

openssl x509 -in file -noout as a pre-deploy smoke test
Never assume file format from extension

When it happens

Trigger: Passing a DER (binary) certificate instead of PEM, passing a private-key-only PEM, passing an empty or truncated file, or corrupt base64 inside the PEM fences.

Common situations: Config pointing at the wrong file (cert file and key file swapped, or a .crt that is actually DER), files corrupted in transfer, or copy-paste PEM with missing BEGIN/END lines.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/6e16079b7cacc717. Report an issue: GitHub.