{"record":{"id":"71b4234678239e8f","repo":"apache/hadoop","slug":"certificateexception-be-sure-not-to-include-pem","errorCode":null,"errorMessage":"CertificateException - be sure not to include PEM header and footer in the PEM configuration element.","messagePattern":"CertificateException - be sure not to include PEM header and footer in the PEM configuration element\\.","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/CertificateUtil.java","lineNumber":60,"sourceCode":"  public static RSAPublicKey parseRSAPublicKey(String pem) throws ServletException {\n    String fullPem = PEM_HEADER + pem + PEM_FOOTER;\n    PublicKey key = null;\n    try {\n      CertificateFactory fact = CertificateFactory.getInstance(\"X.509\");\n      ByteArrayInputStream is = new ByteArrayInputStream(\n          fullPem.getBytes(StandardCharsets.UTF_8));\n\n      X509Certificate cer = (X509Certificate) fact.generateCertificate(is);\n      key = cer.getPublicKey();\n    } catch (CertificateException ce) {\n      String message = null;\n      if (pem.startsWith(PEM_HEADER)) {\n        message = \"CertificateException - be sure not to include PEM header \"\n            + \"and footer in the PEM configuration element.\";\n      } else {\n        message = \"CertificateException - PEM may be corrupt\";\n      }\n      throw new ServletException(message, ce);\n    }\n    return (RSAPublicKey) key;\n  }\n}\n","sourceCodeStart":42,"sourceCodeEnd":65,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/CertificateUtil.java#L42-L65","documentation":"CertificateUtil.parseRSAPublicKey() builds a certificate by wrapping the supplied config string with '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' itself, then hands it to the JDK X.509 CertificateFactory. The input must be ONLY the base64 body. When the input already starts with the PEM header and parsing fails, this ServletException tells you to remove the header and footer lines.","triggerScenarios":"Calling CertificateUtil.parseRSAPublicKey(pem) with a full PEM block (including BEGIN/END lines) copied from 'openssl x509' output, typically via the certificate property of an hadoop-auth authentication handler config; header/footer present with CRLF line endings or a missing newline before the footer so the JDK parser rejects it.","commonSituations":"Operators pasting an entire certificate file into the XML config property instead of just the base64 body; certificates exported on Windows with CR/LF endings; config management templating the whole file in.","solutions":["Strip the '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' lines and configure only the base64 body","Normalize line endings to plain LF and remove stray blank lines before inserting into config","Re-export the certificate body, e.g. 'openssl x509 -in cert.pem -outform PEM | grep -v CERTIFICATE | tr -d '\\r\\n''"],"exampleFix":"# before (config property contains the whole file)\n-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgIE...\n-----END CERTIFICATE-----\n\n# after (config property contains only the body)\nMIIDdzCCAl+gAwIBAgIE...","handlingStrategy":"validation","validationCode":"String pemBodyOnly(String pem) {\n  String p = pem.replaceAll(\"\\\\r\", \"\").trim();\n  p = p.replace(\"-----BEGIN CERTIFICATE-----\", \"\")\n       .replace(\"-----END CERTIFICATE-----\", \"\");\n  return p.replaceAll(\"^\\\\s+|\\\\s+$\", \"\");\n}\n// use: CertificateUtil.parseRSAPublicKey(pemBodyOnly(configPem));","typeGuard":null,"tryCatchPattern":"try { key = CertificateUtil.parseRSAPublicKey(pem); } catch (javax.servlet.ServletException e) { /* surface message, fail startup — do not continue without the key */ }","preventionTips":["Store only the base64 body in config; strip BEGIN/END lines in deployment tooling","Normalize CRLF to LF when generating configs from Windows sources","Add a pre-deploy check that decodes the body as valid base64"],"tags":["hadoop-auth","ssl-certificate","pem","configuration"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}