{"record":{"id":"186b4be305bc2cd8","repo":"cloudflare/cloudflared","slug":"pem-encoding-failed-v","errorCode":null,"errorMessage":"pem encoding failed: %v","messagePattern":"pem encoding failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/origin_cert.go","lineNumber":78,"sourceCode":"}\n\nfunc (cert *OriginCert) EncodeOriginCert() ([]byte, error) {\n\tif cert == nil {\n\t\treturn nil, fmt.Errorf(\"originCert cannot be nil\")\n\t}\n\tbuffer, err := json.Marshal(cert)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"originCert marshal failed: %v\", err)\n\t}\n\tblock := pem.Block{\n\t\tType:    \"ARGO TUNNEL TOKEN\",\n\t\tHeaders: map[string]string{},\n\t\tBytes:   buffer,\n\t}\n\tvar out bytes.Buffer\n\terr = pem.Encode(&out, &block)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pem encoding failed: %v\", err)\n\t}\n\treturn out.Bytes(), nil\n}\n\nfunc decodeOriginCert(blocks []byte) (*OriginCert, error) {\n\tif len(blocks) == 0 {\n\t\treturn nil, fmt.Errorf(\"cannot decode empty certificate\")\n\t}\n\toriginCert := OriginCert{}\n\tblock, rest := pem.Decode(blocks)\n\tfor block != nil {\n\t\tswitch block.Type {\n\t\tcase \"PRIVATE KEY\", \"CERTIFICATE\":\n\t\t\t// this is for legacy purposes.\n\t\tcase \"ARGO TUNNEL TOKEN\":\n\t\t\tif originCert.ZoneID != \"\" || originCert.APIToken != \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"found multiple tokens in the certificate\")\n\t\t\t}","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/credentials/origin_cert.go#L60-L96","documentation":"After building the PEM block, EncodeOriginCert writes it via pem.Encode into a bytes.Buffer; any encoder failure is wrapped as \"pem encoding failed: %v\". This is the final serialization step ensuring the returned bytes are a properly encoded PEM representation of the origin certificate token.","triggerScenarios":"pem.Encode returns a non-nil error while writing the block to the buffer — extremely rare with a bytes.Buffer, but possible if the writer errors; reached whenever EncodeOriginCert is called and marshaling succeeded.","commonSituations":"Essentially only seen in exotic failure conditions or in tests that inject failing writers; if you see it in production, memory/allocation failures during buffer writes are the likely cause.","solutions":["Retry the encode operation — bytes.Buffer failures are typically transient (e.g. OOM)","Check available memory if failures repeat during certificate encoding","Inspect the wrapped error for the underlying writer failure cause","Upgrade Go runtime if the failure traces to a known stdlib pem/writer bug"],"exampleFix":"null","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"out, err := cert.EncodeOriginCert()\nif err != nil {\n\tif strings.Contains(err.Error(), \"pem encoding failed\") {\n\t\tout, err = cert.EncodeOriginCert() // single retry; usually transient\n\t}\n}\nreturn out, err","preventionTips":["Treat pem encode failures as transient and retry once","Monitor memory if this error appears repeatedly under load","Keep the Go toolchain current to benefit from stdlib writer fixes"],"tags":["go","pem","certificate","encoding"],"backgroundTag":"json-serialization-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}