{"record":{"id":"3c1f71d6508a0cfc","repo":"caddyserver/caddy","slug":"can-t-parse-the-given-certificate-s","errorCode":null,"errorMessage":"can't parse the given certificate: %s","messagePattern":"can't parse the given certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":1038,"sourceCode":"\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"leaf module '%s' is not a leaf certificate loader\", vMod)\n\t\t}\n\t\tl.LeafCertificateLoadersRaw = append(\n\t\t\tl.LeafCertificateLoadersRaw,\n\t\t\tcaddyconfig.JSONModuleObject(vMod, \"loader\", modName, nil),\n\t\t)\n\t}\n\treturn nil\n}\n\nfunc (l LeafCertClientAuth) VerifyClientCertificate(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n\tif len(rawCerts) == 0 {\n\t\treturn fmt.Errorf(\"no client certificate provided\")\n\t}\n\n\tremoteLeafCert, err := x509.ParseCertificate(rawCerts[0])\n\tif err != nil {\n\t\treturn fmt.Errorf(\"can't parse the given certificate: %s\", err.Error())\n\t}\n\n\tif slices.ContainsFunc(l.trustedLeafCerts, remoteLeafCert.Equal) {\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"client leaf certificate failed validation\")\n}\n\n// PublicKeyAlgorithm is a JSON-unmarshalable wrapper type.\ntype PublicKeyAlgorithm x509.PublicKeyAlgorithm\n\n// UnmarshalJSON satisfies json.Unmarshaler.\nfunc (a *PublicKeyAlgorithm) UnmarshalJSON(b []byte) error {\n\talgoStr := strings.ToLower(strings.Trim(string(b), `\"`))\n\talgo, ok := publicKeyAlgorithms[algoStr]\n\tif !ok {\n\t\treturn fmt.Errorf(\"unrecognized public key algorithm: %s (expected one of %v)\",","sourceCodeStart":1020,"sourceCodeEnd":1056,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L1020-L1056","documentation":"VerifyClientCertificate takes rawCerts[0] (the client's leaf certificate as sent on the wire) and parses it with x509.ParseCertificate; a parse failure is wrapped as 'can't parse the given certificate'. The bytes came from the TLS peer, so this indicates the peer sent malformed certificate data rather than a config problem.","triggerScenarios":"A TLS client presenting a corrupted, truncated, or non-X.509 certificate; hand-rolled TLS clients that put arbitrary bytes in the Certificate message; middleboxes/terminators that mangle the chain.","commonSituations":"Custom TLS implementations or load tests (e.g. raw TLS scripts) sending garbage; proxies that re-encode certificates badly; extremely rare with mainstream clients — treat as peer-side fault or tampering.","solutions":["Reproduce with a known-good client (openssl s_client -connect host:443 -cert client.pem -key client.key) to confirm the server config is fine","Inspect what the peer sends: capture with tcpdump and decode the Certificate handshake message","Fix or update the offending client's certificate serialization","If behind a proxy/terminator, verify it forwards the original client certificate bytes unchanged"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// If you build custom verifiers on top of x509.ParseCertificate\nif _, err := x509.ParseCertificate(rawCerts[0]); err != nil {\n\t// peer sent malformed certificate bytes; reject and log peer identity (IP/SNI)\n\treturn fmt.Errorf(\"peer sent unparseable certificate: %w\", err)\n}","preventionTips":["Do not hand-roll TLS certificate serialization; use crypto/tls","Validate certs at issue time in your CA/PKI tooling","Treat recurring parse failures from one peer as tampering or a broken client"],"tags":["tls","x509","handshake","client-cert"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}