{"record":{"id":"0cd492b732ada018","repo":"hashicorp/terraform","slug":"could-not-decode-client-certificate-data-v","errorCode":null,"errorMessage":"could not decode client certificate data: %v","messagePattern":"could not decode client certificate data: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":37,"sourceCode":"func logEntry(f string, v ...interface{}) {\n\tif os.Getenv(\"TF_LOG\") == \"\" {\n\t\treturn\n\t}\n\n\tif os.Getenv(\"TF_ACC\") != \"\" {\n\t\treturn\n\t}\n\n\tlog.Printf(f, v...)\n}\n\nfunc decodeCertificate(clientCertificate string) ([]byte, error) {\n\tvar pfx []byte\n\tif clientCertificate != \"\" {\n\t\tout := make([]byte, base64.StdEncoding.DecodedLen(len(clientCertificate)))\n\t\tn, err := base64.StdEncoding.Decode(out, []byte(clientCertificate))\n\t\tif err != nil {\n\t\t\treturn pfx, fmt.Errorf(\"could not decode client certificate data: %v\", err)\n\t\t}\n\t\tpfx = out[:n]\n\t}\n\treturn pfx, nil\n}\n\nfunc getOidcToken(d *backendbase.SDKLikeData) (*string, error) {\n\tidToken := strings.TrimSpace(d.String(\"oidc_token\"))\n\n\tif path := d.String(\"oidc_token_file_path\"); path != \"\" {\n\t\tfileTokenRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading OIDC Token from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileToken := strings.TrimSpace(string(fileTokenRaw))\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L19-L55","documentation":"Raised in decodeCertificate (helpers.go:31-38), called from Backend.Configure when client_certificate is set. The value must be the base64-encoded bytes of a PKCS#12 (.pfx) bundle; this error means base64.StdEncoding.Decode rejected the string. Configure aborts before any network call. It is a pure input-validation error on the certificate value.","triggerScenarios":"Produced at helpers.go:35-37 when base64.StdEncoding.Decode fails on the client_certificate string. Triggered at 'terraform init' as soon as Configure parses the backend block.","commonSituations":"Pasting the raw (non-base64) PFX bytes; including PEM headers; a trailing newline or whitespace in the env var; copy truncation; using a file path instead of the encoded content (should use client_certificate_path for paths).","solutions":["Re-encode the PFX file as base64: base64 -w0 cert.pfx (Linux) or [Convert]::ToBase64String([IO.File]::ReadAllBytes('cert.pfx')) (PowerShell)","Ensure no PEM headers / newlines are included — use the raw PFX bytes base64-encoded","If you have a file path, use client_certificate_path instead of client_certificate","Verify the base64 decodes: echo '<value>' | base64 -d | head -c4 | xxd (should start with PKCS magic bytes 30 82)"],"exampleFix":"# before: raw/PEM content in client_certificate (decoding fails)\nexport ARM_CLIENT_CERTIFICATE=\"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\"\n\n# after: base64-encode the binary PFX\ncert_b64=$(base64 -w0 cert.pfx)\nexport ARM_CLIENT_CERTIFICATE=\"$cert_b64\"\n# or, point at the file instead:\nexport ARM_CLIENT_CERTIFICATE_PATH=\"$PWD/cert.pfx\"","handlingStrategy":"validation","validationCode":"# Validate the client_certificate is decodable base64 (PKCS#12) before terraform init\nvalidate_pfx_b64() {\n  val=\"$1\"\n  [ -n \"$val\" ] || return 0\n  # reject PEM-looking content\n  case \"$val\" in *BEGIN*CERTIFICATE*) echo \"FAIL: looks like PEM, not base64 PFX\"; return 1;; esac\n  decoded=$(printf '%s' \"$val\" | base64 -d 2>/dev/null) || { echo \"FAIL: not valid base64 (error 159)\"; return 1; }\n  # PKCS#12 magic: 30 82\n  printf '%s' \"$val\" | base64 -d | head -c2 | od -An -tx1 | grep -qi '30 82' \\\n    && echo \"OK: valid base64 PFX\" || echo \"WARN: decoded but not PKCS#12 magic\"\n}\nvalidate_pfx_b64 \"$ARM_CLIENT_CERTIFICATE\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Encode with base64 -w0 (no line wrapping) for env vars","Prefer client_certificate_path pointing at the .pfx file over inlining the blob","Never paste PEM content into client_certificate; it must be binary PFX, base64-encoded"],"tags":["azure","authentication","certificate","base64","validation","service-principal"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}