{"record":{"id":"3a3d911eeeb3a963","repo":"t8y2/dbx","slug":"pem-truststore-contains-no-certificates-3a3d91","errorCode":null,"errorMessage":"PEM truststore contains no certificates","messagePattern":"PEM truststore contains no certificates","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":224,"sourceCode":"func parsePEMCertificates(contents []byte) ([]*x509.Certificate, error) {\n\tvar certificates []*x509.Certificate\n\tfor len(contents) > 0 {\n\t\tblock, rest := pem.Decode(contents)\n\t\tif block == nil {\n\t\t\tbreak\n\t\t}\n\t\tcontents = rest\n\t\tif block.Type != \"CERTIFICATE\" {\n\t\t\tcontinue\n\t\t}\n\t\tcertificate, err := x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tcertificates = append(certificates, certificate)\n\t}\n\tif len(certificates) == 0 {\n\t\treturn nil, errors.New(\"PEM truststore contains no certificates\")\n\t}\n\treturn certificates, nil\n}\n\nfunc parsePrivateKey(contents []byte) (any, error) {\n\tif value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\tif value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\tif value, err := x509.ParseECPrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\treturn nil, errors.New(\"unsupported private key encoding\")\n}\n","sourceCodeStart":206,"sourceCodeEnd":241,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L206-L241","documentation":"parsePEMCertificates scans PEM blocks from a truststore file and found no parseable CERTIFICATE blocks, so loadTrustStore cannot build a CA pool. The library refuses to continue with an empty trust store.","triggerScenarios":"The file referenced as a PEM truststore is empty, contains only a private key or non-certificate PEM blocks (e.g. only PUBLIC KEY), or the certs are in DER (binary) rather than PEM format.","commonSituations":"Pointing the truststore at a DER-encoded .crt; wrong file path resolving to an empty/placeholder file; a file containing concatenated keys but no certificates.","solutions":["Verify the file contains BEGIN CERTIFICATE blocks: grep -c 'BEGIN CERTIFICATE' truststore.pem (must be > 0).","Convert DER certs to PEM: openssl x509 -inform DER -in ca.crt -out ca.pem, then reference the PEM file.","Fix the path configuration so the truststore points to the actual CA bundle file."],"exampleFix":"# before\ntruststorePath=/etc/ssl/certs/ca.der\n# after\nopenssl x509 -inform DER -in /etc/ssl/certs/ca.der -out /etc/ssl/certs/ca.pem\ntruststorePath=/etc/ssl/certs/ca.pem","handlingStrategy":"validation","validationCode":"func pemTruststoreHasCerts(path string) error {\n\tb, err := os.ReadFile(path); if err != nil { return err }\n\tif !bytes.Contains(b, []byte(\"-----BEGIN CERTIFICATE-----\")) {\n\t\treturn errors.New(\"no PEM certificates in \" + path)\n\t}\n\treturn nil\n}","typeGuard":"func isPEMCertificateBlock(block *pem.Block) bool { return block != nil && block.Type == \"CERTIFICATE\" }","tryCatchPattern":"pool, err := loadTrustStore(path)\nif err != nil {\n\tif strings.Contains(err.Error(), \"no certificates\") {\n\t\treturn fmt.Errorf(\"truststore %s has no PEM certs; convert DER with 'openssl x509 -inform DER'\", path)\n\t}\n\treturn err\n}","preventionTips":["Always distribute CA bundles in PEM format for this driver.","Sanity-check with 'grep -c BEGIN CERTIFICATE file' before referencing a truststore path.","Avoid pointing truststore config at keystores or key files by mistake — validate file contents at startup."],"tags":["tls","pem","truststore","certificates","zookeeper"],"backgroundTag":"empty-truststore","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}