{"record":{"id":"0190985df356ea6d","repo":"siyuan-note/siyuan","slug":"failed-to-decode-certificate-pem","errorCode":null,"errorMessage":"failed to decode certificate PEM","messagePattern":"failed to decode certificate PEM","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/util/cert.go","lineNumber":245,"sourceCode":"\t\treturn nil, nil, err\n\t}\n\n\tcert, err = x509.ParseCertificate(certDER)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\treturn certDER, cert, nil\n}\n\nfunc loadX509Certificate(certPath string) (*x509.Certificate, error) {\n\tcertPEM, err := os.ReadFile(certPath)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, _ := pem.Decode(certPEM)\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode certificate PEM\")\n\t}\n\treturn x509.ParseCertificate(block.Bytes)\n}\n\n// Loads the CA certificate and private key from files\nfunc loadCA(certPath, keyPath string) (*x509.Certificate, any, error) {\n\tcertPEM, err := os.ReadFile(certPath)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tblock, _ := pem.Decode(certPEM)\n\tif block == nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to decode CA certificate PEM\")\n\t}\n\n\tcaCert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/8641553a1f07374001902d3ce773285db1292b2d/kernel/util/cert.go#L227-L263","documentation":"loadX509Certificate decodes a PEM-encoded certificate and returns this error when pem.Decode yields no block — i.e. the byte slice is not valid PEM (missing -----BEGIN CERTIFICATE----- armor, empty data, or binary content). The error prevents further x509 parsing of garbage input.","triggerScenarios":"generateServerCert or the TLS cert-refresh tests passing a certificate that fails PEM decoding: an empty cert file, a key pasted where a cert is expected, a DER-encoded (binary) certificate, or text with the PEM armor stripped.","commonSituations":"Configuring TLS with the wrong file (private key instead of certificate); files corrupted by editors or download truncation; certificates exported in DER format instead of PEM.","solutions":["Ensure the certificate file is PEM-encoded and starts with -----BEGIN CERTIFICATE-----","Verify you are not passing the private key or CA file where the leaf certificate is expected","Convert DER certificates to PEM: openssl x509 -inform der -in cert.der -out cert.pem"],"exampleFix":"// before: binary DER bytes handed to generateServerCert\ncertPEM, _ := os.ReadFile(\"server.der\")\n// after: use the PEM-encoded certificate\ncertPEM, _ := os.ReadFile(\"server.pem\") // -----BEGIN CERTIFICATE----- ...","handlingStrategy":"validation","validationCode":"const fs = require(\"fs\");\nconst pem = fs.readFileSync(certPath, \"utf8\");\nif (!pem.includes(\"-----BEGIN CERTIFICATE-----\")) {\n  throw new Error(`${certPath} is not a PEM certificate`);\n}","typeGuard":null,"tryCatchPattern":"cert, err := loadX509Certificate(certPEM)\nif err != nil {\n  return fmt.Errorf(\"loading server cert %s: %w\", certPath, err)\n}","preventionTips":["Keep cert and key files clearly named and separate","Always export certificates in PEM, not DER","Sanity-check files with openssl x509 before deployment"],"tags":["tls","pem","certificate"],"backgroundTag":"invalid-argument-format","analyzedSha":"8641553a1f07374001902d3ce773285db1292b2d","analyzedAt":"2026-09-11T16:08:28.414Z","contentChangedAt":"2026-09-11T16:08:28.414Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}