{"record":{"id":"0db642d475a6c9d1","repo":"kubernetes/kops","slug":"error-parsing-certificate-v","errorCode":null,"errorMessage":"error parsing certificate: %v","messagePattern":"error parsing certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/certificate.go","lineNumber":61,"sourceCode":"\ts := \"\"\n\tif err := json.Unmarshal(b, &s); err == nil {\n\t\tr, err := ParsePEMCertificate([]byte(s))\n\t\tif err != nil {\n\t\t\t// Alternative form: Check if base64 encoded\n\t\t\t// TODO: Do we need this?  I think we need this only on nodeup, but maybe we could just not base64-it?\n\t\t\td, err2 := base64.StdEncoding.DecodeString(s)\n\t\t\tif err2 == nil {\n\t\t\t\tr2, err2 := ParsePEMCertificate(d)\n\t\t\t\tif err2 == nil {\n\t\t\t\t\tklog.Warningf(\"used base64 decode of certificate\")\n\t\t\t\t\tr = r2\n\t\t\t\t\terr = nil\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif err != nil {\n\t\t\t\tklog.Infof(\"Invalid certificate data: %q\", string(b))\n\t\t\t\treturn fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t\t}\n\t\t}\n\t\t*c = *r\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"unknown format for Certificate: %q\", string(b))\n}\n\nfunc (c *Certificate) MarshalJSON() ([]byte, error) {\n\tvar data bytes.Buffer\n\t_, err := c.WriteTo(&data)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error writing SSL certificate: %v\", err)\n\t}\n\treturn json.Marshal(data.String())\n}\n\nfunc ParsePEMCertificate(pemData []byte) (*Certificate, error) {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/certificate.go#L43-L79","documentation":"Certificate.UnmarshalJSON accepts JSON strings containing PEM-encoded certificates, decodes base64/PEM blocks, and parses them into an x509 certificate. If all decode attempts fail to yield a parseable certificate, it logs the invalid data and returns \"error parsing certificate: %v\". A JSON string that decodes but is not a certificate is instead rejected with a separate \"unknown format\" error.","triggerScenarios":"Unmarshaling a Certificate from JSON whose string is not valid PEM/base64 x509 data; parsing a kops cluster/instance group YAML with a hand-edited or corrupted certificate field.","commonSituations":"Copy-pasting a certificate that lost its BEGIN/END lines or newlines during YAML editing; using a private key where a certificate is expected; expired/truncated cert blobs from a secrets manager export.","solutions":["Verify the field contains a full PEM certificate including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.","Check the cert decodes: openssl x509 -in cert.pem -text -noout; re-export from the source.","Ensure you did not paste the private key or CSR instead of the certificate.","Check for YAML indentation/line-folding damage that stripped newlines, and re-run kops."],"exampleFix":"// before (YAML)\ncertificate: LS0tLS1CRUdJTiBD...TRUNCATED\n// after\ncertificate: |\n  -----BEGIN CERTIFICATE-----\n  MIID...full base64...\n  -----END CERTIFICATE-----","handlingStrategy":"validation","validationCode":"func validPEMCert(s string) bool {\n    block, _ := pem.Decode([]byte(s))\n    if block == nil || block.Type != \"CERTIFICATE\" { return false }\n    _, err := x509.ParseCertificate(block.Bytes)\n    return err == nil\n}\nif !validPEMCert(certString) { return errors.New(\"invalid certificate before unmarshal\") }","typeGuard":null,"tryCatchPattern":"if err := json.Unmarshal(data, &cert); err != nil {\n    if strings.Contains(err.Error(), \"error parsing certificate\") {\n        // re-fetch/repair the PEM blob before retrying\n    }\n    return err\n}","preventionTips":["Store certificates with full BEGIN/END lines and intact newlines (YAML block scalar '|')","Validate with openssl x509 before committing to config","Never paste private keys or CSRs into certificate fields","Use kops create secret instead of hand-editing manifests"],"tags":["pki","certificate","json-parsing"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}