{"record":{"id":"2d8ca0182f128099","repo":"caddyserver/caddy","slug":"parsing-certificate-at-index-d-v","errorCode":null,"errorMessage":"parsing certificate at index %d: %v","messagePattern":"parsing certificate at index (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/capools.go","lineNumber":77,"sourceCode":"\n// CaddyModule implements caddy.Module.\nfunc (icp InlineCAPool) CaddyModule() caddy.ModuleInfo {\n\treturn caddy.ModuleInfo{\n\t\tID: \"tls.ca_pool.source.inline\",\n\t\tNew: func() caddy.Module {\n\t\t\treturn new(InlineCAPool)\n\t\t},\n\t}\n}\n\n// Provision implements caddy.Provisioner.\nfunc (icp *InlineCAPool) Provision(ctx caddy.Context) error {\n\tcaPool := x509.NewCertPool()\n\tvar certs []*x509.Certificate\n\tfor i, clientCAString := range icp.TrustedCACerts {\n\t\tclientCA, err := decodeBase64DERCert(clientCAString)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"parsing certificate at index %d: %v\", i, err)\n\t\t}\n\t\tcaPool.AddCert(clientCA)\n\t\tcerts = append(certs, clientCA)\n\t}\n\ticp.pool = caPool\n\ticp.certs = certs\n\n\treturn nil\n}\n\n// Syntax:\n//\n//\ttrust_pool inline {\n//\t\ttrust_der <base64_der_cert>...\n//\t}\n//\n// The 'trust_der' directive can be specified multiple times.\nfunc (icp *InlineCAPool) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/capools.go#L59-L95","documentation":"InlineCAPool.Provision decodes each entry of trusted_ca_certs (base64-encoded DER certificates) with decodeBase64DERCert. When an entry is not valid base64, not DER, or not an X.509 certificate, provisioning of the client CA pool fails, reporting the failing index so you can locate the bad entry.","triggerScenarios":"Configuring client_auth.trusted_ca_certs (or the Caddyfile trusted_ca_cert_file's inline sibling) with a value that is a PEM string instead of base64 DER, has trailing whitespace/newline corruption, uses URL-safe instead of standard base64, or is a truncated copy-paste.","commonSituations":"Copy-pasting a PEM block (-----BEGIN CERTIFICATE-----) into a field that expects bare base64 DER; line-wrapped base64 pasted with literal '\\n' characters; using the certificate's fingerprint instead of the certificate.","solutions":["Convert the PEM to base64 DER: openssl x509 -in ca.pem -outform der | base64 -w0, then use that string.","Check the reported index against your trusted_ca_certs array to find the exact bad entry.","Alternatively use trusted_ca_certs_pem_files (PEM file path) which avoids the conversion entirely.","Verify the string is a single unbroken standard-alphabet base64 blob with no stray characters."],"exampleFix":"# before (PEM text stuffed into the base64-DER field)\n\"trusted_ca_certs\": [\"-----BEGIN CERTIFICATE-----\\nMIIF...\"]\n\n# after (base64 DER)\nopenssl x509 -in ca.pem -outform der | base64 -w0\n\"trusted_ca_certs\": [\"MIIFazCCA...=\"]","handlingStrategy":"validation","validationCode":"// Pre-check each inline cert exactly as Caddy does.\nfor i, s := range poolCfg.TrustedCACerts {\n    if _, err := decodeBase64DERCert(s); err != nil { // or inline: base64 decode + x509.ParseCertificate\n        return fmt.Errorf(\"trusted_ca_certs[%d] invalid: %v\", i, err)\n    }\n}","typeGuard":"func isBase64DERCert(s string) bool {\n    der, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s))\n    if err != nil {\n        return false\n    }\n    _, err = x509.ParseCertificate(der)\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Generate the value with openssl x509 -outform der | base64 -w0, never paste PEM text.","Automate cert-bundle generation in config pipelines so hand-conversion errors cannot occur.","Prefer PEM file references when hand-editing configs."],"tags":["tls","client-auth","certificates","base64","configuration"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}