{"record":{"id":"3e069027306f32c6","repo":"t8y2/dbx","slug":"neo4j-ca-certificate-contains-no-valid-pem-certifi","errorCode":null,"errorMessage":"Neo4j CA certificate contains no valid PEM certificate","messagePattern":"Neo4j CA certificate contains no valid PEM certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/neo4j-go/driver.go","lineNumber":82,"sourceCode":"\tif tlsConfigurer != nil {\n\t\tconfigurers = append(configurers, tlsConfigurer)\n\t}\n\treturn neo4j.NewDriver(uri, authToken, configurers...)\n}\n\nfunc neo4jTLSConfigurer(params connectParams) (func(*config.Config), error) {\n\tvar tlsConfig *tls.Config\n\tif params.CACertPath != \"\" {\n\t\tcertificate, err := os.ReadFile(params.CACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Neo4j CA certificate: %w\", err)\n\t\t}\n\t\troots, err := x509.SystemCertPool()\n\t\tif err != nil || roots == nil {\n\t\t\troots = x509.NewCertPool()\n\t\t}\n\t\tif !roots.AppendCertsFromPEM(certificate) {\n\t\t\treturn nil, errors.New(\"Neo4j CA certificate contains no valid PEM certificate\")\n\t\t}\n\t\ttlsConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: roots}\n\t}\n\tvar clientCertificateProvider neo4jauth.ClientCertificateProvider\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"both client certificate and client key are required\")\n\t\t}\n\t\tprovider, err := neo4jauth.NewStaticClientCertificateProvider(neo4jauth.ClientCertificate{\n\t\t\tCertFile: params.ClientCertPath,\n\t\t\tKeyFile:  params.ClientKeyPath,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Neo4j client certificate: %w\", err)\n\t\t}\n\t\tclientCertificateProvider = provider\n\t}\n\tif tlsConfig == nil && clientCertificateProvider == nil {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/neo4j-go/driver.go#L64-L100","documentation":"During TLS configuration for the Neo4j driver, the certificate file contents are parsed into the x509 root pool via AppendCertsFromPEM. This function returns false when the byte slice contains no valid PEM-encoded certificate blocks, so the configurer aborts rather than building a driver with no trust anchors. It means the CA certificate file is missing, empty, or not PEM format (e.g. DER/binary).","triggerScenarios":"Calling openDriver with a TLS scheme (neo4j+s / bolt+s) and params.CertPath (or equivalent CA config) pointing to an empty file, a DER-encoded certificate, a private key instead of a cert, or a truncated/garbage file.","commonSituations":"Pointing the CA path at the wrong file (key vs cert), exporting certs in DER (.cer/.der) format from Windows, env var containing a path that resolves to an empty file in a container, copy-paste errors that drop the BEGIN/END lines.","solutions":["Verify the CA file is PEM format: it must contain -----BEGIN CERTIFICATE----- blocks (run `openssl x509 -in ca.pem -text -noout`).","Convert DER to PEM if needed: `openssl x509 -inform der -in cert.cer -out cert.pem`.","Check the path/env var actually points to the CA cert file, not the key or another file, and that the file is non-empty.","If using a chain, ensure at least the CA block is present and not truncated (full concatenated PEM chain is fine)."],"exampleFix":"// before\ncaCert, _ := os.ReadFile(\"./certs/ca.cer\") // DER file -> AppendCertsFromPEM fails\n// after\ncaCert, _ := os.ReadFile(\"./certs/ca.pem\") // PEM-encoded CA certificate","handlingStrategy":"validation","validationCode":"pem, err := os.ReadFile(caCertPath)\nif err != nil || len(pem) == 0 {\n    return fmt.Errorf(\"CA cert unreadable/empty: %s\", caCertPath)\n}\nif !strings.Contains(string(pem), \"-----BEGIN CERTIFICATE-----\") {\n    return fmt.Errorf(\"CA cert is not PEM: %s\", caCertPath)\n}\npool := x509.NewCertPool()\nif !pool.AppendCertsFromPEM(pem) {\n    return fmt.Errorf(\"CA cert contains no valid PEM block: %s\", caCertPath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always distribute CA certs in PEM format, not DER","Run `openssl x509 -in ca.pem -text -noout` when provisioning certs","Validate cert file contents at config-load time, before connecting","Avoid copy-pasting certs; mount them as files to preserve BEGIN/END blocks"],"tags":["tls","neo4j","certificate","pem"],"backgroundTag":"invalid-ca-certificate","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}