{"record":{"id":"37ec79339329676c","repo":"argoproj/argo-workflows","slug":"failed-to-parse-certificate-w","errorCode":null,"errorMessage":"failed to parse certificate: %w","messagePattern":"failed to parse certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/serviceaccount/claims.go","lineNumber":85,"sourceCode":"\t}\n\tclaims.ServiceAccountNamespace = parts[2]\n\tclaims.ServiceAccountName = parts[3]\n\n\treturn claims, nil\n}\n\nfunc ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {\n\tvar cert *x509.Certificate\n\tvar err error\n\tif len(restConfig.CertData) > 0 {\n\t\t// Decode certificate from memory data\n\t\tblock, _ := pem.Decode(restConfig.CertData)\n\t\tif block == nil || block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate PEM\")\n\t\t}\n\t\tcert, err = x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t\t}\n\t} else {\n\t\t// Load certificate from file\n\t\tdata, err := os.ReadFile(restConfig.CertFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read certificate file: %w\", err)\n\t\t}\n\t\tblock, _ := pem.Decode(data)\n\t\tif block == nil || block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate PEM\")\n\t\t}\n\t\tcert, err = x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t\t}\n\t}\n\n\tif cert == nil {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/serviceaccount/claims.go#L67-L103","documentation":"ClaimSetWithX509 builds auth claims from the client certificate embedded in a kube rest.Config. When inline CertData is present, it PEM-decodes the block and calls x509.ParseCertificate; if the DER bytes inside the PEM block are not a valid X.509 certificate, the underlying parse error is wrapped as 'failed to parse certificate: %w'. This guards against corrupt or non-certificate data being used for identity extraction.","triggerScenarios":"restConfig.CertData is non-empty and pem.Decode succeeds on a CERTIFICATE-typed block, but x509.ParseCertificate rejects the DER payload — e.g. truncated bytes, an RSA/EC PRIVATE KEY block relabeled as CERTIFICATE, or a certificate format x509 does not support (e.g. some Ed25519/PKCS variants).","commonSituations":"Users base64-decode the kubeconfig client-certificate-data incorrectly (wrong key, double encoding), paste a CSR or private key instead of the cert, or copy/paste through a tool that mangles characters in the base64 body.","solutions":["Verify CertData is the exact base64 of a PEM CERTIFICATE block: run `base64 -d` on client-certificate-data from the kubeconfig and inspect with `openssl x509 -in cert.pem -text -noout`","Regenerate/extract the client cert from the kubeconfig with `kubectl config view --raw --minify --flatten -o jsonpath='{.users[0].user.client-certificate-data}' | base64 -d` and feed that bytes back","Confirm the PEM block type is CERTIFICATE and not PRIVATE KEY/CSR; swap in the correct artifact if not"],"exampleFix":"// before: CertData = base64 of a private key\nrestConfig.CertData = base64StdDecodedPrivateKeyPEM\n// after: CertData = base64 of the client certificate\nrestConfig.CertData = base64StdDecoded(clientCertPEM)","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(restConfig.CertData)\nif block == nil || block.Type != \"CERTIFICATE\" {\n    return errors.New(\"CertData is not a PEM CERTIFICATE block\")\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    return fmt.Errorf(\"CertData is not a valid X.509 certificate: %w\", err)\n}","typeGuard":"func isPEMCertificate(data []byte) bool {\n    block, _ := pem.Decode(data)\n    return block != nil && block.Type == \"CERTIFICATE\"\n}","tryCatchPattern":null,"preventionTips":["Always extract cert data via `kubectl config view --raw` + base64 -d rather than manual copy/paste","Keep cert PEM and key PEM in separate files/fields; never point CertData at a private key","Round-trip validate with `openssl x509 -noout` before deploying a certificate","Avoid re-encoding an already-encoded certificate (single base64 layer only)"],"tags":["x509","tls","authentication","argo-server"],"backgroundTag":"x509-certificate-parse-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}