{"record":{"id":"37952569ffda2b40","repo":"hashicorp/nomad","slug":"failed-to-parse-s-bytes-w","errorCode":null,"errorMessage":"failed to parse %s bytes: %w","messagePattern":"failed to parse (.+?) bytes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/oidc/client_assertion.go","lineNumber":180,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"error reading %s: %w\", source, err)\n\t\t}\n\t}\n\t// or pem string\n\tif k.PemCert != \"\" {\n\t\tsource = \"PemCert\"\n\t\tbts = []byte(k.PemCert)\n\t}\n\n\t// ensure newlines around pem header/footer\n\tbts = newlineHeaders(bts)\n\n\tblock, _ := pem.Decode(bts)\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode %s PEM block\", source)\n\t}\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse %s bytes: %w\", source, err)\n\t}\n\tnow := time.Now()\n\tif now.Before(cert.NotBefore) || now.After(cert.NotAfter) {\n\t\treturn nil, errors.New(\"certificate has expired or is not yet valid\")\n\t}\n\treturn cert, nil\n}\n\n// hashKeyID derives a \"certificate thumbprint\" that the OIDC provider uses\n// to find the certificate to verify the private key JWT signature.\n// https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.7\nfunc hashKeyID(cert *x509.Certificate, header structs.OIDCClientAssertionKeyIDHeader) (string, error) {\n\tvar hasher hash.Hash\n\tswitch header {\n\tcase structs.OIDCClientAssertionHeaderX5t:\n\t\tif fips140.Enabled() {\n\t\t\treturn \"\", errors.New(\"x5t assertion headers use SHA-1, which is forbidden in FIPS-140 mode\")\n\t\t}","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/auth/oidc/client_assertion.go#L162-L198","documentation":"getCassCert decodes a PEM blob and parses the first certificate. This error wraps the x509.ParseCertificate failure, meaning the PEM block decoded successfully but its DER payload is not a valid X.509 certificate (or is truncated/corrupt). The wrapped error (%w) carries the underlying asn.1 parse detail.","triggerScenarios":"BuildClientAssertionJWT loads a key/cert blob via getCassCert where pem.Decode succeeds but block.Bytes is not parseable DER — e.g. the file contains a PUBLIC KEY, PRIVATE KEY, CSR, or arbitrary base64 block instead of a CERTIFICATE; or the cert body was truncated/edited.","commonSituations":"Misconfigured Nomad OIDC client assertion key file pointing at a private key (.key) or public key instead of the certificate; copy-paste truncating PEM body; wrong file mounted in a secret; multi-document PEM where the first block is not the certificate.","solutions":["Inspect the file and confirm the block is a full '-----BEGIN CERTIFICATE-----' PEM with an intact base64 body","If the file is a private key or public key, export the matching certificate (e.g. openssl x509 -in req.pem -out cert.pem) and point the config at it","Verify integrity with: openssl x509 -in <file> -noout -text; fix or regenerate the certificate","Regenerate the keypair/certificate and re-upload via the OIDC client upsert"],"exampleFix":"// before (config pointed at private key)\nclient_assertion_key = \"/etc/nomad/oidc/client.key\"\n// after (point at the X.509 certificate)\nclient_assertion_key = \"/etc/nomad/oidc/client.crt\"","handlingStrategy":"validation","validationCode":"pemBytes, _ := os.ReadFile(certPath)\nblock, _ := pem.Decode(pemBytes)\nif block == nil || block.Type != \"CERTIFICATE\" {\n\treturn fmt.Errorf(\"%s is not a CERTIFICATE PEM block\", certPath)\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n\treturn fmt.Errorf(\"cert at %s is not valid DER: %w\", certPath, err)\n}","typeGuard":"func isCertificatePEM(b []byte) bool {\n\tblock, _ := pem.Decode(b)\n\treturn block != nil && block.Type == \"CERTIFICATE\"\n}","tryCatchPattern":null,"preventionTips":["Point config at the .crt/.pem certificate, never the private key file","Validate with `openssl x509 -in file -noout` during provisioning","Keep PEM files intact — avoid manual copy/paste edits that truncate base64","Verify certificate validity window (NotBefore/NotAfter) before deploying"],"tags":["pem","x509","certificate","oidc"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}