apache/hadoop · error · ServletException

CertificateException - be sure not to include PEM header and

Error message

CertificateException - be sure not to include PEM header and footer in the PEM configuration element.

What it means

CertificateUtil.parseRSAPublicKey() builds a certificate by wrapping the supplied config string with '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' itself, then hands it to the JDK X.509 CertificateFactory. The input must be ONLY the base64 body. When the input already starts with the PEM header and parsing fails, this ServletException tells you to remove the header and footer lines.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/CertificateUtil.java:60

  public static RSAPublicKey parseRSAPublicKey(String pem) throws ServletException {
    String fullPem = PEM_HEADER + pem + PEM_FOOTER;
    PublicKey key = null;
    try {
      CertificateFactory fact = CertificateFactory.getInstance("X.509");
      ByteArrayInputStream is = new ByteArrayInputStream(
          fullPem.getBytes(StandardCharsets.UTF_8));

      X509Certificate cer = (X509Certificate) fact.generateCertificate(is);
      key = cer.getPublicKey();
    } catch (CertificateException ce) {
      String message = null;
      if (pem.startsWith(PEM_HEADER)) {
        message = "CertificateException - be sure not to include PEM header "
            + "and footer in the PEM configuration element.";
      } else {
        message = "CertificateException - PEM may be corrupt";
      }
      throw new ServletException(message, ce);
    }
    return (RSAPublicKey) key;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Strip the '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' lines and configure only the base64 body
2. Normalize line endings to plain LF and remove stray blank lines before inserting into config
3. Re-export the certificate body, e.g. 'openssl x509 -in cert.pem -outform PEM | grep -v CERTIFICATE | tr -d '\r\n''

Example fix

# before (config property contains the whole file)
-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIE...
-----END CERTIFICATE-----

# after (config property contains only the body)
MIIDdzCCAl+gAwIBAgIE...

String pemBodyOnly(String pem) {
  String p = pem.replaceAll("\\r", "").trim();
  p = p.replace("-----BEGIN CERTIFICATE-----", "")
       .replace("-----END CERTIFICATE-----", "");
  return p.replaceAll("^\\s+|\\s+$", "");
}
// use: CertificateUtil.parseRSAPublicKey(pemBodyOnly(configPem));

try { key = CertificateUtil.parseRSAPublicKey(pem); } catch (javax.servlet.ServletException e) { /* surface message, fail startup — do not continue without the key */ }

When it happens

Trigger: Calling CertificateUtil.parseRSAPublicKey(pem) with a full PEM block (including BEGIN/END lines) copied from 'openssl x509' output, typically via the certificate property of an hadoop-auth authentication handler config; header/footer present with CRLF line endings or a missing newline before the footer so the JDK parser rejects it.

Common situations: Operators pasting an entire certificate file into the XML config property instead of just the base64 body; certificates exported on Windows with CR/LF endings; config management templating the whole file in.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• CertificateException - PEM may be corrupt
• Authentication type must be specified: simple|kerberos|<clas
• No secret in signature secret file: ${signatureSecretFile}
• Could not read signature secret file: ${signatureSecretFile}
• signer.secret.provider.zookeeper.path must be specified

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/71b4234678239e8f. Report an issue: GitHub.