{"record":{"id":"4c918917052fde07","repo":"hyperledger/fabric","slug":"s-wrong-pem-encoding","errorCode":null,"errorMessage":"%s: wrong PEM encoding","messagePattern":"(.+?): wrong PEM encoding","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/crypto/tlsgen/key.go","lineNumber":104,"sourceCode":"\t}\n\ttemplate.SubjectKeyId, err = computeSKI(&privateKey.PublicKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\t// If no parent cert, it's a self signed cert\n\tif parent == nil || certSigner == nil {\n\t\tparent = &template\n\t\tcertSigner = privateKey\n\t}\n\trawBytes, err := x509.CreateCertificate(rand.Reader, &template, parent, &privateKey.PublicKey, certSigner)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpubKey := encodePEM(\"CERTIFICATE\", rawBytes)\n\n\tblock, _ := pem.Decode(pubKey)\n\tif block == nil { // Never comes unless x509 or pem has bug\n\t\treturn nil, errors.Errorf(\"%s: wrong PEM encoding\", pubKey)\n\t}\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tprivKey := encodePEM(\"EC PRIVATE KEY\", privBytes)\n\treturn &CertKeyPair{\n\t\tKey:     privKey,\n\t\tCert:    pubKey,\n\t\tSigner:  privateKey,\n\t\tTLSCert: cert,\n\t}, nil\n}\n\nfunc encodePEM(keyType string, data []byte) []byte {\n\treturn pem.EncodeToMemory(&pem.Block{Type: keyType, Bytes: data})\n}\n","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/crypto/tlsgen/key.go#L86-L122","documentation":"newCertKeyPair generates a key/cert and PEM-encodes it, then immediately decodes the CERTIFICATE PEM block to parse it. A nil block means the PEM-encoding produced bytes that pem.Decode cannot parse — per the comment, this should never happen unless x509/pem are buggy. The error message embeds the offending PEM bytes.","triggerScenarios":"Calling NewCA, NewIntermediateCA, NewClientCertKeyPair, or NewServerCertKeyPair when pem.Decode of the freshly generated CERTIFICATE PEM returns nil (crypto/tls or encoding/pem internal failure).","commonSituations":"Practically only hit with corrupted Go crypto stacks or extreme resource failures during cert generation; effectively an internal invariant violation.","solutions":["Retry the CA/cert generation call — this is an unexpected internal failure","Verify the Go runtime version and update to a supported release","Report a bug with Go/ fabric versions if reproducible"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"kp, err := tlsgen.NewCA()\nif err != nil && strings.Contains(err.Error(), \"wrong PEM encoding\") {\n    return retryCA() // transient crypto-stack failure; retry\n}","preventionTips":["Keep the Go runtime updated to a supported release","Treat this as an invariant violation — log and report if reproducible","Retry generation once before failing hard"],"tags":["tls","pem","certificate","crypto"],"backgroundTag":"wrong-pem-encoding","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}