{"record":{"id":"6af14e2979e5fa61","repo":"caddyserver/caddy","slug":"parsing-certificate-s-v","errorCode":null,"errorMessage":"parsing certificate '%s': %v","messagePattern":"parsing certificate '(.+?)': (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/capools.go","lineNumber":444,"sourceCode":"\tfor _, caID := range ca.PEMKeys {\n\t\tbs, err := ca.storage.Load(ctx, caID)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading cert '%s' from storage: %s\", caID, err)\n\t\t}\n\t\t// Parse PEM to extract certificates\n\t\tpemData := bs\n\t\tfor len(pemData) > 0 {\n\t\t\tvar block *pem.Block\n\t\t\tblock, pemData = pem.Decode(pemData)\n\t\t\tif block == nil {\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tif block.Type != \"CERTIFICATE\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tcert, err := x509.ParseCertificate(block.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing certificate '%s': %v\", caID, err)\n\t\t\t}\n\t\t\tcaPool.AddCert(cert)\n\t\t\tcerts = append(certs, cert)\n\t\t}\n\t}\n\tca.pool = caPool\n\tca.certs = certs\n\n\treturn nil\n}\n\n// Syntax:\n//\n//\ttrust_pool storage [<storage_keys>...] {\n//\t\tstorage <storage_module>\n//\t\tkeys\t<storage_keys>...\n//\t}\n//","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/capools.go#L426-L462","documentation":"A storage-backed trust pool found a PEM block of type CERTIFICATE at the given storage key, but x509.ParseCertificate failed to parse its DER bytes. The data at that key is not a valid X.509 certificate even though it is PEM-framed.","triggerScenarios":"The stored blob contains a malformed or truncated certificate, a PEM CERTIFICATE block wrapping non-certificate DER (e.g. a CSR or garbage), or a corrupted upload.","commonSituations":"Manually pasted certificates with copy/paste damage; base64 payload truncated; wrong file uploaded to the storage key (e.g. a key or CSR saved as .pem).","solutions":["Inspect the object at the failing key with `openssl x509 -in file.pem -noout -text` to confirm it parses.","Replace the corrupt blob with the correct certificate PEM and reload Caddy.","If the PEM intentionally contains non-cert blocks, note only CERTIFICATE blocks are parsed — make sure at least the real cert is intact."],"exampleFix":"# before (storage object contains truncated PEM)\n-----BEGIN CERTIFICATE-----\nMIIB...truncated\n\n# after (valid full certificate)\n-----BEGIN CERTIFICATE-----\nMIIB...full base64...\n-----END CERTIFICATE-----","handlingStrategy":"validation","validationCode":"// validate a PEM blob parses as X.509 before uploading to storage\nfunc validPEMCerts(data []byte) error {\n\trest := data\n\tfor {\n\t\tvar block *pem.Block\n\t\tblock, rest = pem.Decode(rest)\n\t\tif block == nil {\n\t\t\tbreak\n\t\t}\n\t\tif block.Type != \"CERTIFICATE\" {\n\t\t\tcontinue\n\t\t}\n\t\tif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n\t\t\treturn fmt.Errorf(\"bad certificate block: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run `openssl x509 -noout -text` on every bundle member before publishing it.","Automate bundle generation (cat of full PEM files) instead of hand-editing.","Checksum bundles on upload and verify on the consuming side."],"tags":["caddy","caddytls","certificate","pem","parsing"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}