{"record":{"id":"3d0bcb1a582c91f7","repo":"caddyserver/caddy","slug":"no-certificate-pem-block-found-in-s","errorCode":null,"errorMessage":"no CERTIFICATE pem block found in %s","messagePattern":"no CERTIFICATE pem block found in (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":764,"sourceCode":"\tif len(ca.TrustedCACerts) > 0 {\n\t\tfileMod := &InlineCAPool{}\n\t\tfileMod.TrustedCACerts = append(fileMod.TrustedCACerts, ca.TrustedCACerts...)\n\t\tca.CARaw = caddyconfig.JSONModuleObject(fileMod, \"provider\", \"inline\", nil)\n\t\tca.TrustedCACertPEMFiles, ca.TrustedCACerts = nil, nil\n\t}\n\treturn nil\n}\n\nfunc convertPEMFilesToDER(filename string) ([]string, error) {\n\tcertDataPEM, err := os.ReadFile(filename)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvar ders []string\n\t// while block is not nil, we have more certificates in the file\n\tfor block, rest := pem.Decode(certDataPEM); block != nil; block, rest = pem.Decode(rest) {\n\t\tif block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"no CERTIFICATE pem block found in %s\", filename)\n\t\t}\n\t\tders = append(\n\t\t\tders,\n\t\t\tbase64.StdEncoding.EncodeToString(block.Bytes),\n\t\t)\n\t}\n\t// if we decoded nothing, return an error\n\tif len(ders) == 0 {\n\t\treturn nil, fmt.Errorf(\"no CERTIFICATE pem block found in %s\", filename)\n\t}\n\treturn ders, nil\n}\n\nfunc (clientauth *ClientAuthentication) provision(ctx caddy.Context) error {\n\tif len(clientauth.CARaw) > 0 && (len(clientauth.TrustedCACerts) > 0 || len(clientauth.TrustedCACertPEMFiles) > 0) {\n\t\treturn fmt.Errorf(\"conflicting config for client authentication trust CA\")\n\t}\n","sourceCodeStart":746,"sourceCodeEnd":782,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L746-L782","documentation":"Returned by convertPEMFilesToDER, used when a Caddyfile trusted_ca_cert_file (or trusted_leaf_cert_file) is read: the file was read successfully but contains either zero PEM blocks or a block whose type is not CERTIFICATE (e.g. a private key or a CSR). The filename in the message identifies the offending file.","triggerScenarios":"Pointing trusted_ca_cert_file at: an empty file, a DER (binary) certificate instead of PEM, a file containing a PRIVATE KEY block, or a file with only non-CERTIFICATE PEM blocks. Every block in the file must be a CERTIFICATE block.","commonSituations":"Operator passes the server's fullchain.pem where a CA bundle was expected and it still parses until a non-cert block appears; file is actually DER-encoded; file truncated to zero bytes by a failed provisioner; correct path but wrong file (key file).","solutions":["Inspect the file: 'openssl x509 -in <file> -text -noout' should parse it as PEM (or grep for BEGIN CERTIFICATE)","If it is DER, convert: 'openssl x509 -inform der -in cert.der -out cert.pem'","Remove any PRIVATE KEY or other non-certificate blocks from the file","Re-download the CA bundle if it is empty or truncated"],"exampleFix":"# before\nclient_auth {\n\ttrusted_ca_cert_file /etc/candy/ca.pem # typo'd dir -> empty file\n}\n\n# after\nclient_auth {\n\ttrusted_ca_cert_file /etc/caddy/ca.pem\n}","handlingStrategy":"validation","validationCode":"# Validate a CA file before referencing it in config:\nopenssl x509 -in /etc/caddy/ca.pem -noout >/dev/null 2>&1 \\\n  && echo OK || echo \"not a PEM certificate file\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Feed trusted_ca_cert_file only CA bundles in PEM format (BEGIN CERTIFICATE blocks)","Convert DER to PEM with openssl x509 -inform der before use","Never point this directive at key files, CSRs, or full server chains with mixed block types","Add a CI check that greps referenced cert files for 'BEGIN CERTIFICATE'"],"tags":["caddy","tls","pem","certificates","client-auth","file-io"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}