{"record":{"id":"351e01b470ddbb54","repo":"gchq/CyberChef","slug":"unsupported-pem-type-match-1","errorCode":null,"errorMessage":"Unsupported PEM type '${match[1]}'","messagePattern":"Unsupported PEM type '(.+?)'","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PEMToJWK.mjs","lineNumber":81,"sourceCode":"                if (key.type === \"DSA\") {\n                    throw new OperationError(\"DSA keys are not supported for JWK\");\n                }\n                const jwk = r.KEYUTIL.getJWKFromKey(key);\n                if (output.length > 0) {\n                    output += \"\\n\";\n                }\n                output += JSON.stringify(jwk);\n            } else if (match[1] === \"CERTIFICATE\") {\n                const cert = new r.X509();\n                cert.readCertPEM(pem);\n                const key = cert.getPublicKey();\n                const jwk = r.KEYUTIL.getJWKFromKey(key);\n                if (output.length > 0) {\n                    output += \"\\n\";\n                }\n                output += JSON.stringify(jwk);\n            } else {\n                throw new OperationError(`Unsupported PEM type '${match[1]}'`);\n            }\n        }\n        return output;\n    }\n}\n\nexport default PEMToJWK;\n","sourceCodeStart":63,"sourceCodeEnd":89,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PEMToJWK.mjs#L63-L89","documentation":"PEMToJWK handles only two block categories: labels containing 'KEY' (parsed as a key) and the exact label 'CERTIFICATE'. Any other matched label falls through to this else branch. The BEGIN regex requires uppercase letters and spaces, so it can match labels like 'X509 CRL' or 'EC PARAMETERS' that this operation cannot convert.","triggerScenarios":"Input contains a PEM block whose label is neither a *KEY nor 'CERTIFICATE' - e.g. '-----BEGIN X509 CRL-----', '-----BEGIN EC PARAMETERS-----', or '-----BEGIN TRUSTED CERTIFICATE-----'.","commonSituations":"Pasting a CRL, parameters block, or non-key/cert PEM alongside real keys; mixed bundles where an unhandled block type appears; concatenated files (key + CRL).","solutions":["Remove or isolate non-key / non-certificate PEM blocks from the input.","For certificates use the exact label 'CERTIFICATE'; for keys ensure the label contains 'KEY'.","Pre-filter input to keep only BEGIN ... KEY and BEGIN CERTIFICATE blocks."],"exampleFix":"// before: bundle includes an unhandled block type\n-----BEGIN X509 CRL-----\n...\n// after: pass only key/certificate blocks\n-----BEGIN CERTIFICATE-----\n...","handlingStrategy":"validation","validationCode":"function classifyPemBlocks(pem) {\n    const re = /-----BEGIN ([A-Z][A-Z ]+[A-Z])-----/g;\n    const supported = [], unsupported = [];\n    let m;\n    while ((m = re.exec(pem)) !== null) {\n        (m[1].includes('KEY') || m[1] === 'CERTIFICATE' ? supported : unsupported).push(m[1]);\n    }\n    return { supported, unsupported };\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Feed only KEY- or CERTIFICATE-labelled PEM blocks to PEMToJWK.","Strip CRL, parameters, and other block types before conversion.","Pre-scan input to reject unsupported labels."],"tags":["pem","parsing","jwk","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}