{"record":{"id":"26e584a873807994","repo":"temporalio/temporal","slug":"failed-to-load-decoded-ca-cert-as-pem","errorCode":null,"errorMessage":"failed to load decoded CA Cert as PEM","messagePattern":"failed to load decoded CA Cert as PEM","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/persistence/nosql/nosqlplugin/cassandra/gocql/client.go","lineNumber":122,"sourceCode":"\t\t}\n\n\t\tif len(certBytes) > 0 {\n\t\t\tclientCert, err := tls.X509KeyPair(certBytes, keyBytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"unable to generate x509 key pair: %w\", err)\n\t\t\t}\n\n\t\t\tcluster.SslOpts.Certificates = []tls.Certificate{clientCert}\n\t\t}\n\n\t\tif cfg.TLS.CaData != \"\" {\n\t\t\tcluster.SslOpts.RootCAs = x509.NewCertPool()\n\t\t\tpem, err := base64.StdEncoding.DecodeString(cfg.TLS.CaData)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"caData could not be decoded: %w\", err)\n\t\t\t}\n\t\t\tif !cluster.SslOpts.RootCAs.AppendCertsFromPEM(pem) {\n\t\t\t\treturn errors.New(\"failed to load decoded CA Cert as PEM\")\n\t\t\t}\n\t\t}\n\t}\n\n\tif cfg.MaxConns > 0 {\n\t\tcluster.NumConns = cfg.MaxConns\n\t}\n\n\tcluster.ConnectTimeout = 10 * time.Second * debug.TimeoutMultiplier\n\tif cfg.ConnectTimeout > 0 {\n\t\tcluster.ConnectTimeout = cfg.ConnectTimeout\n\t}\n\n\tcluster.Timeout = cluster.ConnectTimeout\n\tif cfg.Timeout > 0 {\n\t\tcluster.Timeout = cfg.Timeout\n\t}\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/persistence/nosql/nosqlplugin/cassandra/gocql/client.go#L104-L140","documentation":"When CaData is supplied, ConfigureCassandraCluster base64-decodes it and appends the resulting bytes to an x509 CertPool with AppendCertsFromPEM. This error means the decoded bytes were not parseable as PEM certificate(s), so the root CA pool would be empty and TLS verification would fail. AppendCertsFromPEM returns false silently, and the plugin turns that into this error.","triggerScenarios":"Calling NewCassandraCluster with cfg.TLS.CaData set to a non-empty value that is valid base64 but whose decoded bytes are not PEM-formatted certificates (or are a private key/CSR instead of a CA cert).","commonSituations":"Passing raw PEM text (-----BEGIN CERTIFICATE-----) as caData instead of base64-encoding it first; base64-encoding a DER binary when AppendCertsFromPEM needs PEM; including only the intermediate cert with formatting damage (CRLF stripped, extra whitespace); encoding the wrong file.","solutions":["Base64-encode the PEM CA certificate file: base64 -w0 ca.pem, and put that string in caData","Verify with: echo \"$caData\" | base64 -d | openssl x509 -text -noout, confirming a CA certificate is printed","Ensure the file contains the CA cert(s) with PEM headers intact and no leading/trailing junk","If you only have DER format, convert first: openssl x509 -inform DER -in ca.der -out ca.pem"],"exampleFix":"// before\ncaData: \"-----BEGIN CERTIFICATE-----\\nMIIFaz...\"   // raw PEM, not base64\n// after (shell)\ncaData: \"$(base64 -w0 ca.pem)\"                         // base64 of PEM bytes\n","handlingStrategy":"validation","validationCode":"caData, err := base64.StdEncoding.DecodeString(cfg.TLS.CaData)\nif err != nil {\n    return fmt.Errorf(\"caData is not valid base64: %w\", err)\n}\nif !x509.NewCertPool().AppendCertsFromPEM(caData) {\n    return errors.New(\"caData does not decode to PEM certificates\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate caData with `base64 -w0 ca.pem` and verify with `echo $caData | base64 -d | openssl x509 -text`","Keep the PEM headers intact; never strip BEGIN/END lines","Confirm the encoded file is a CA certificate, not a leaf key or CSR","Watch for YAML line-wrapping/escaping corrupting long base64 strings"],"tags":["cassandra","tls","x509","pem"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}