apache/cassandra · error · GeneralSecurityException

Failed to decode given base64 input. msg=

Error message

Failed to decode given base64 input. msg=

What it means

decodeBase64 wraps the JDK strict Base64 decoder; when the extracted base64 payload between the PEM BEGIN/END markers contains illegal characters (anything outside A-Z, a-z, 0-9, +, /, = after whitespace is stripped), IllegalArgumentException is rethrown as this GeneralSecurityException. It means the body of the PEM block is not valid base64.

Source

Thrown at src/java/org/apache/cassandra/security/PEMReader.java:282

        return certificateList;
    }

    /**
     * Decodes given input in Base64 format.
     *
     * @param base64Input input to be decoded
     * @return byte[] containing decoded bytes
     * @throws GeneralSecurityException in case it fails to decode the given base64 input
     */
    private static byte[] decodeBase64(String base64Input) throws GeneralSecurityException
    {
        try
        {
            return Base64.getDecoder().decode(base64Input);
        }
        catch (IllegalArgumentException e)
        {
            throw new GeneralSecurityException("Failed to decode given base64 input. msg=" + e.getMessage(), e);
        }
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Inspect the base64 body for illegal characters (smart quotes, non-ASCII, 'Proc-Type'/'DEK-Info' headers) and regenerate/re-export the PEM file cleanly
2. Re-export the key/certificate from the source keystore rather than copy/pasting content
3. Check line encoding — rewrite the file with Unix line endings (dos2unix) if it came from Windows
4. Enable debug logging on PEMReader and decode the extracted base64 manually to locate the offending character
5. If headers exist above the key body (traditional encrypted format), convert to PKCS#8: openssl pkcs8 -topk8

Example fix

# before: traditional encrypted PEM with headers inside the block
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,...
...
# after: convert to PKCS#8 PEM
openssl pkcs8 -topk8 -in trad-key.pem -out cassandra-pkcs8.key

// Validate the PEM body is strict base64 before calling the API
static boolean isValidPemBase64(String pem) {
    java.util.regex.Matcher m = java.util.regex.Pattern.compile(
        "-+BEGIN\\s+.*PRIVATE\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+([a-z0-9+/=\\r\\n]+)-+END", java.util.regex.Pattern.CASE_INSENSITIVE)
        .matcher(pem);
    if (!m.find()) return false;
    try { java.util.Base64.getDecoder().decode(m.group(1).replaceAll("\\s", "")); return true; }
    catch (IllegalArgumentException e) { return false; }
}

try {
    Certificate[] certs = PEMReader.extractCertificates(pemCerts);
} catch (GeneralSecurityException e) {
    if (e.getMessage().startsWith("Failed to decode given base64 input")) {
        logger.error("PEM body contains non-base64 characters - re-export the key/cert cleanly (check encoding, headers, copy/paste artifacts)", e);
    }
    throw e;
}

When it happens

Trigger: Calling PEMReader.extractPrivateKey or extractCertificates where the base64 body of the PEM block contains characters the strict decoder rejects — e.g. headers like 'Proc-Type: 4,ENCRYPTED' left inside the block, base64 with url-safe characters (-, _) instead of standard (+, /), embedded comments, or non-ASCII characters introduced by copy/paste or encoding conversion.

Common situations: Copy-pasting keys from a web page or terminal that introduced smart quotes or hidden characters; YAML folding mangling the base64 body; a legacy encrypted PEM whose 'Proc-Type'/'DEK-Info' headers were not stripped before the base64 region; a key encoded in base64url or SSH format rather than standard PEM base64.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• The given private key could not be parsed with any of the su
• Invalid private key format
• Invalid certificate format
• Credential format error: username or password is empty or co
• Access denied

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/8b9b61bd4d960df3. Report an issue: GitHub.