{"record":{"id":"6e4d265280282dd8","repo":"siyuan-note/siyuan","slug":"failed-to-parse-ca-certificate-w","errorCode":null,"errorMessage":"failed to parse CA certificate: %w","messagePattern":"failed to parse CA certificate: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/util/cert.go","lineNumber":323,"sourceCode":"\t}\n\n\tif err = pem.Encode(keyFile, &pem.Block{Type: \"EC PRIVATE KEY\", Bytes: keyDER}); err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// ImportCABundle imports a CA certificate and private key from PEM-encoded strings.\nfunc ImportCABundle(caCertPEM, caKeyPEM string) error {\n\tcertBlock, _ := pem.Decode([]byte(caCertPEM))\n\tif certBlock == nil {\n\t\treturn fmt.Errorf(\"failed to decode CA certificate PEM\")\n\t}\n\n\tcaCert, err := x509.ParseCertificate(certBlock.Bytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse CA certificate: %w\", err)\n\t}\n\n\tif !caCert.IsCA {\n\t\treturn fmt.Errorf(\"the provided certificate is not a CA certificate\")\n\t}\n\n\tkeyBlock, _ := pem.Decode([]byte(caKeyPEM))\n\tif keyBlock == nil {\n\t\treturn fmt.Errorf(\"failed to decode CA private key PEM\")\n\t}\n\n\t_, err = x509.ParseECPrivateKey(keyBlock.Bytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse CA private key: %w\", err)\n\t}\n\n\tcaCertPath := filepath.Join(ConfDir, TLSCACertFilename)\n\tcaKeyPath := filepath.Join(ConfDir, TLSCAKeyFilename)","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/util/cert.go#L305-L341","documentation":"Returned by ImportCABundle when x509.ParseCertificate fails on the bytes decoded from the PEM block. The PEM was well-formed, but its contents are not a parseable X.509 certificate (corrupted DER, truncated, or a non-certificate PEM type that happened to decode).","triggerScenarios":"Calling ImportCABundle with a PEM block whose decoded bytes are not a valid ASN.1 X.509 certificate — e.g. a PKCS#7 bundle, a CSR, or a truncated cert.","commonSituations":"Using the wrong PEM file (a CSR or a PKCS#7 `.p7b` instead of a leaf CA cert); a cert that was mangled in transit; a PEM whose label says CERTIFICATE but whose payload is something else.","solutions":["Verify the file with `openssl x509 -in ca.pem -noout -text`; if it errors, obtain a correct X.509 cert.","If you have a PKCS#7 bundle, extract the leaf cert first (`openssl pkcs7 -in ca.p7b -print_certs -out ca.pem`).","Make sure the PEM block type is `CERTIFICATE`."],"exampleFix":"// before: passing a PKCS#7 bundle whose decoded bytes are not a raw cert\nImportCABundle(pkcs7PEM, keyPEM) // -> failed to parse CA certificate\n\n// after: extract the X.509 leaf cert from the bundle, then import\nImportCABundle(leafCertPEM, keyPEM)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := util.ImportCABundle(certPEM, keyPEM); err != nil {\n    if strings.Contains(err.Error(), \"failed to parse CA certificate\") {\n        // PEM decoded but DER is not X.509; likely a CSR, PKCS#7, or wrong file\n        return fmt.Errorf(\"%v; verify with `openssl x509 -in ca.pem -noout -text`\", err)\n    }\n    return err\n}","preventionTips":["Use a PEM file whose block type is `CERTIFICATE` and that contains exactly one X.509 certificate.","Extract the leaf cert from PKCS#7 bundles before importing.","Do not pass CSRs (CERTIFICATE REQUEST) as the CA cert."],"tags":["tls","cert","x509","ca","crypto"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}