{"record":{"id":"725f60b0594c006f","repo":"hashicorp/nomad","slug":"no-pem-encoded-data-found-725f60","errorCode":null,"errorMessage":"no PEM-encoded data found","messagePattern":"no PEM-encoded data found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":288,"sourceCode":"\t// This is not standard; RFC allows any unique identifier as long as they\n\t// match in subject/authority chains but suggests specific hashing of DER\n\t// bytes of public key including DER tags.\n\tbs, err := x509.MarshalPKIXPublicKey(raw)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// String formatted\n\tkID := sha256.Sum256(bs)\n\treturn kID[:], nil\n}\n\n// ParseCert parses the x509 certificate from a PEM-encoded value.\nfunc ParseCert(pemValue string) (*x509.Certificate, error) {\n\t// The _ result below is not an error but the remaining PEM bytes.\n\tblock, _ := pem.Decode([]byte(pemValue))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"no PEM-encoded data found\")\n\t}\n\n\tif block.Type != \"CERTIFICATE\" {\n\t\treturn nil, fmt.Errorf(\"first PEM-block should be CERTIFICATE type\")\n\t}\n\n\treturn x509.ParseCertificate(block.Bytes)\n}\n\nfunc parseCert(pemValue string) (*x509.Certificate, error) {\n\t// The _ result below is not an error but the remaining PEM bytes.\n\tblock, _ := pem.Decode([]byte(pemValue))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"no PEM-encoded data found\")\n\t}\n\n\tif block.Type != \"CERTIFICATE\" {\n\t\treturn nil, fmt.Errorf(\"first PEM-block should be CERTIFICATE type\")","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L270-L306","documentation":"The public ParseCert could not find any PEM block in the provided string: pem.Decode returned nil. The input is empty, whitespace, or not PEM-formatted at all, so no certificate can be parsed from it.","triggerScenarios":"Calling ParseCert(\"\") or ParseCert with raw DER bytes (no -----BEGIN CERTIFICATE----- armor), base64-without-PEM output, truncated PEM missing the BEGIN line, or config fields that were never populated.","commonSituations":"Reading a cert from a config value or Consul KV key that is empty; passing a file path instead of file contents; stripping PEM headers during preprocessing; Windows line-ending or encoding corruption that breaks the BEGIN/END markers.","solutions":["Verify the input actually contains a PEM block starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----.","Read the certificate file's contents, not its path, before calling ParseCert.","Check the config/KV source for empty or truncated values.","If you have raw DER, wrap it with pem.EncodeToMemory yourself or use x509.ParseCertificate directly."],"exampleFix":"// before\nparsed, err := tlsutil.ParseCert(certPath)\n// after\ncertPEM, err := os.ReadFile(certPath)\nif err != nil { return err }\nparsed, err := tlsutil.ParseCert(string(certPEM))","handlingStrategy":"validation","validationCode":"func hasCertPEM(s string) bool {\n\tblock, _ := pem.Decode([]byte(s))\n\treturn block != nil && block.Type == \"CERTIFICATE\"\n}","typeGuard":"func isPEMCertificate(s string) bool {\n\tblock, _ := pem.Decode([]byte(s))\n\treturn block != nil && block.Type == \"CERTIFICATE\"\n}","tryCatchPattern":"cert, err := tlsutil.ParseCert(pemValue)\nif err != nil {\n\tif strings.Contains(err.Error(), \"no PEM-encoded data found\") {\n\t\treturn fmt.Errorf(\"certificate input is empty or not PEM-encoded: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Validate non-empty PEM content before calling ParseCert.","Pass file contents, not paths.","Never preprocess PEM in ways that strip BEGIN/END headers.","Store raw DER separately from PEM; this parser expects PEM."],"tags":["tls","pem","certificate-parsing","input-validation"],"backgroundTag":"no-pem-data-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}