{"record":{"id":"5a6decc2daf354a3","repo":"golang/go","slug":"tls-failed-to-parse-client-certificate-err","errorCode":null,"errorMessage":"tls: failed to parse client certificate: {err}","messagePattern":"tls: failed to parse client certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_server.go","lineNumber":950,"sourceCode":"\tif _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {\n\t\treturn err\n\t}\n\n\tcopy(out, finished.verifyData)\n\n\treturn nil\n}\n\n// processCertsFromClient takes a chain of client certificates either from a\n// certificateMsg message or a certificateMsgTLS13 message and verifies them.\nfunc (c *Conn) processCertsFromClient(certificate Certificate) error {\n\tcertificates := certificate.Certificate\n\tcerts := make([]*x509.Certificate, len(certificates))\n\tvar err error\n\tfor i, asn1Data := range certificates {\n\t\tif certs[i], err = x509.ParseCertificate(asn1Data); err != nil {\n\t\t\tc.sendAlert(alertDecodeError)\n\t\t\treturn errors.New(\"tls: failed to parse client certificate: \" + err.Error())\n\t\t}\n\t\tif certs[i].PublicKeyAlgorithm == x509.RSA {\n\t\t\tn := certs[i].PublicKey.(*rsa.PublicKey).N.BitLen()\n\t\t\tif max, ok := checkKeySize(n); !ok {\n\t\t\t\tc.sendAlert(alertBadCertificate)\n\t\t\t\treturn fmt.Errorf(\"tls: client sent certificate containing RSA key larger than %d bits\", max)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {\n\t\tif c.vers == VersionTLS13 {\n\t\t\tc.sendAlert(alertCertificateRequired)\n\t\t} else {\n\t\t\tc.sendAlert(alertHandshakeFailure)\n\t\t}\n\t\treturn errors.New(\"tls: client didn't provide a certificate\")\n\t}","sourceCodeStart":932,"sourceCodeEnd":968,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_server.go#L932-L968","documentation":"processCertsFromClient failed to ASN.1-parse one of the client's certificate bytes via x509.ParseCertificate. The bytes are not a valid X.509 certificate. The server alerts decode_error and surfaces the wrapped parse error.","triggerScenarios":"For each asn1Data entry in certificate.Certificate, x509.ParseCertificate returns an error — malformed DER, truncated bytes, wrong tag, or non-X.509 structure. The server sends alertDecodeError.","commonSituations":"A client sending a corrupt or truncated certificate chain, a misconfigured client presenting a PEM-encoded (not DER) certificate, a bug in certificate generation, or an attacker injecting garbage into the certificate field.","solutions":["Regenerate the client certificate with a known-good tool (openssl x509, cfssl) and ensure DER encoding is sent over the wire.","Inspect the wrapped err to identify the ASN.1 failure point (e.g. 'sequence tag mismatch').","Verify the certificate validates independently: openssl x509 -in client.crt -noout -text.","If the client is third-party, request they resend a valid chain."],"exampleFix":"// Before: client sent a PEM-encoded cert (wrong for TLS wire format)\nblock, _ := pem.Decode(pemBytes)\n// forgot to use block.Bytes\n\n// After: send DER bytes\ncert := tls.Certificate{\n    Certificate: [][]byte{block.Bytes}, // DER, not PEM\n    PrivateKey:  priv,\n}","handlingStrategy":"validation","validationCode":"// Client: validate the cert parses as DER before adding to tls.Certificate.\nfor i, der := range derCerts {\n    if _, err := x509.ParseCertificate(der); err != nil {\n        return fmt.Errorf(\"cert[%d] invalid: %w\", i, err)\n    }\n}\ncert := tls.Certificate{Certificate: derCerts, PrivateKey: priv}","typeGuard":null,"tryCatchPattern":"// Server: log the wrapped parse error for diagnosis.\nif err != nil && strings.Contains(err.Error(), \"failed to parse client certificate\") {\n    log.Warn(\"client sent malformed cert\", \"err\", err)\n}","preventionTips":["Always DER-encode certificates for the TLS wire format (use block.Bytes from pem.Decode, not the raw PEM).","Validate certs with openssl x509 before deploying.","Run client cert generation through vetted tooling."],"tags":["tls","server-handshake","client-certificate","x509","asn1","decode-error"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}