{"record":{"id":"224638877fc94350","repo":"siyuan-note/siyuan","slug":"failed-to-decode-ca-private-key-pem","errorCode":null,"errorMessage":"failed to decode CA private key PEM","messagePattern":"failed to decode CA private key PEM","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/util/cert.go","lineNumber":332,"sourceCode":"// ImportCABundle imports a CA certificate and private key from PEM-encoded strings.\nfunc ImportCABundle(caCertPEM, caKeyPEM string) error {\n\tcertBlock, _ := pem.Decode([]byte(caCertPEM))\n\tif certBlock == nil {\n\t\treturn fmt.Errorf(\"failed to decode CA certificate PEM\")\n\t}\n\n\tcaCert, err := x509.ParseCertificate(certBlock.Bytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse CA certificate: %w\", err)\n\t}\n\n\tif !caCert.IsCA {\n\t\treturn fmt.Errorf(\"the provided certificate is not a CA certificate\")\n\t}\n\n\tkeyBlock, _ := pem.Decode([]byte(caKeyPEM))\n\tif keyBlock == nil {\n\t\treturn fmt.Errorf(\"failed to decode CA private key PEM\")\n\t}\n\n\t_, err = x509.ParseECPrivateKey(keyBlock.Bytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse CA private key: %w\", err)\n\t}\n\n\tcaCertPath := filepath.Join(ConfDir, TLSCACertFilename)\n\tcaKeyPath := filepath.Join(ConfDir, TLSCAKeyFilename)\n\n\tif err := os.WriteFile(caCertPath, []byte(caCertPEM), 0644); err != nil {\n\t\treturn fmt.Errorf(\"failed to write CA certificate: %w\", err)\n\t}\n\n\tif err := os.WriteFile(caKeyPath, []byte(caKeyPEM), 0600); err != nil {\n\t\treturn fmt.Errorf(\"failed to write CA private key: %w\", err)\n\t}\n","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/util/cert.go#L314-L350","documentation":"Returned by ImportCABundle when pem.Decode on caKeyPEM returns nil — the private key input is not valid PEM. Mirrors the cert-side decode check; the key must be wrapped in proper PEM markers before it can be parsed.","triggerScenarios":"Calling ImportCABundle with a caKeyPEM argument that pem.Decode cannot parse (missing markers, DER form, empty, wrong label).","commonSituations":"Supplying a raw base64 key, a DER-encoded key, or a PKCS#8 key whose PEM type is not what the decoder expects; truncated key.","solutions":["Provide the key as PEM, e.g. `-----BEGIN EC PRIVATE KEY----- ... -----END EC PRIVATE KEY-----`.","Convert a DER key: `openssl ec -in ca.key.der -inform DER -out ca.key.pem -outform PEM`.","Confirm the PEM block type matches an EC private key encoding."],"exampleFix":"// before\nImportCABundle(certPEM, derKey) // -> failed to decode CA private key PEM\n\n// after\nImportCABundle(certPEM, \"-----BEGIN EC PRIVATE KEY-----\\n\"+pemBody+\"\\n-----END EC PRIVATE KEY-----\\n\")","handlingStrategy":"validation","validationCode":"// Confirm the key decodes as PEM before importing.\nif block, _ := pem.Decode([]byte(caKeyPEM)); block == nil {\n    return fmt.Errorf(\"ca key is not valid PEM; include BEGIN/END EC PRIVATE KEY markers\")\n}\nreturn util.ImportCABundle(caCertPEM, caKeyPEM)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass the key wrapped in PEM markers, not raw base64 or DER.","Use `openssl ec -in key.der -inform DER -out key.pem -outform PEM` to convert.","Ensure the PEM block type matches an EC private key encoding."],"tags":["tls","key","pem","ca","crypto"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}