{"record":{"id":"6e16079b7cacc717","repo":"XTLS/Xray-core","slug":"no-certificates-were-found-while-parsing-the-bundl","errorCode":null,"errorMessage":"no certificates were found while parsing the bundle","messagePattern":"no certificates were found while parsing the bundle","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/ocsp/ocsp.go","lineNumber":132,"sourceCode":"\tvar certDERBlock *pem.Block\n\n\tfor {\n\t\tcertDERBlock, bundle = pem.Decode(bundle)\n\t\tif certDERBlock == nil {\n\t\t\tbreak\n\t\t}\n\n\t\tif certDERBlock.Type == \"CERTIFICATE\" {\n\t\t\tcert, err := x509.ParseCertificate(certDERBlock.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tcertificates = append(certificates, cert)\n\t\t}\n\t}\n\n\tif len(certificates) == 0 {\n\t\treturn nil, errors.New(\"no certificates were found while parsing the bundle\")\n\t}\n\n\treturn certificates, nil\n}\n","sourceCodeStart":114,"sourceCodeEnd":137,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/ocsp/ocsp.go#L114-L137","documentation":"Returned by parsePEMBundle after scanning the entire input when zero PEM blocks of type CERTIFICATE were successfully parsed. Either the input is not PEM at all, or all blocks failed x509.ParseCertificate / were of a non-certificate type.","triggerScenarios":"Passing a DER (binary) certificate instead of PEM, passing a private-key-only PEM, passing an empty or truncated file, or corrupt base64 inside the PEM fences.","commonSituations":"Config pointing at the wrong file (cert file and key file swapped, or a .crt that is actually DER), files corrupted in transfer, or copy-paste PEM with missing BEGIN/END lines.","solutions":["Check the file starts with '-----BEGIN CERTIFICATE-----' and ends with '-----END CERTIFICATE-----'","If it is DER, convert with openssl: `openssl x509 -inform der -in cert.der -out cert.pem`","Validate with `openssl x509 -in cert.pem -noout` to confirm the file parses on its own"],"exampleFix":"# convert DER to PEM\nopenssl x509 -inform der -in ca.der -out ca.pem","handlingStrategy":"validation","validationCode":"if !bytes.HasPrefix(pemBundle, []byte(\"-----BEGIN\")) {\n    return errors.New(\"input is not PEM; convert DER with openssl x509 -inform der\")\n}","typeGuard":"func looksLikePEMBundle(b []byte) bool { return bytes.Contains(b, []byte(\"-----BEGIN CERTIFICATE-----\")) }","tryCatchPattern":null,"preventionTips":["openssl x509 -in file -noout as a pre-deploy smoke test","Never assume file format from extension"],"tags":["tls","certificate","pem","parsing"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}