apache/hadoop · error · ServletException

CertificateException - PEM may be corrupt

Error message

CertificateException - PEM may be corrupt

What it means

The other failure branch of CertificateUtil.parseRSAPublicKey(): the input did not start with the PEM header, so the code wrapped it with header/footer itself, yet the JDK CertificateFactory still threw CertificateException. This means the base64 body itself is not parseable as an X.509 certificate.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/CertificateUtil.java:60

  public static RSAPublicKey parseRSAPublicKey(String pem) throws ServletException {
    String fullPem = PEM_HEADER + pem + PEM_FOOTER;
    PublicKey key = null;
    try {
      CertificateFactory fact = CertificateFactory.getInstance("X.509");
      ByteArrayInputStream is = new ByteArrayInputStream(
          fullPem.getBytes(StandardCharsets.UTF_8));

      X509Certificate cer = (X509Certificate) fact.generateCertificate(is);
      key = cer.getPublicKey();
    } catch (CertificateException ce) {
      String message = null;
      if (pem.startsWith(PEM_HEADER)) {
        message = "CertificateException - be sure not to include PEM header "
            + "and footer in the PEM configuration element.";
      } else {
        message = "CertificateException - PEM may be corrupt";
      }
      throw new ServletException(message, ce);
    }
    return (RSAPublicKey) key;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the body decodes standalone: wrap it with BEGIN/END CERTIFICATE lines and run 'openssl x509 -in wrapped.pem -noout'
2. If you exported a bare public key, export the certificate instead ('openssl x509 -in cert.pem') and use its base64 body
3. Remove \r, spaces and stray characters, and ensure the base64 text is complete

Example fix

# before: body of a bare RSA public key (not a certificate)
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

# after: base64 body of the X.509 certificate containing that key
openssl x509 -in server-cert.pem | sed -n '2,$p' | head -n -1

boolean looksLikeCertBody(String pem) {
  String body = pem.replaceAll("\\s", "");
  if (!body.matches("[A-Za-z0-9+/]+=*")) return false;
  try { java.util.Base64.getDecoder().decode(body); return true; }
  catch (IllegalArgumentException e) { return false; }
}

try { RSAPublicKey k = CertificateUtil.parseRSAPublicKey(pem); } catch (ServletException e) { /* fail fast; check cause chain for the CertificateException */ }

When it happens

Trigger: Passing a bare public key PEM ('-----BEGIN PUBLIC KEY-----' body from 'openssl rsa -pubout') instead of a certificate; truncated base64 body; body containing whitespace, dashes, or other non-base64 characters; a DER-encoded (binary) certificate pasted into config.

Common situations: Users extracting only the key pair with openssl and assuming the public key equals the certificate; copy/paste losing characters; terminal line-wrap injecting breaks into long base64 lines.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• CertificateException - be sure not to include PEM header and
• Authentication type must be specified: simple|kerberos|<clas
• No secret in signature secret file: ${signatureSecretFile}
• Could not read signature secret file: ${signatureSecretFile}
• signer.secret.provider.zookeeper.path must be specified

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/df04eb79c5ad8309. Report an issue: GitHub.