{"record":{"id":"a3d270fe08c86bb1","repo":"argoproj/argo-workflows","slug":"failed-to-parse-certificate-pem","errorCode":null,"errorMessage":"failed to parse certificate PEM","messagePattern":"failed to parse certificate PEM","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/serviceaccount/claims.go","lineNumber":81,"sourceCode":"\t// note that the SA name can have a colon in it, although the rest cannot\n\tparts = strings.SplitN(claims.Subject, \":\", 4)\n\tif len(parts) < 4 {\n\t\treturn claims, nil\n\t}\n\tclaims.ServiceAccountNamespace = parts[2]\n\tclaims.ServiceAccountName = parts[3]\n\n\treturn claims, nil\n}\n\nfunc ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {\n\tvar cert *x509.Certificate\n\tvar err error\n\tif len(restConfig.CertData) > 0 {\n\t\t// Decode certificate from memory data\n\t\tblock, _ := pem.Decode(restConfig.CertData)\n\t\tif block == nil || block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate PEM\")\n\t\t}\n\t\tcert, err = x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t\t}\n\t} else {\n\t\t// Load certificate from file\n\t\tdata, err := os.ReadFile(restConfig.CertFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read certificate file: %w\", err)\n\t\t}\n\t\tblock, _ := pem.Decode(data)\n\t\tif block == nil || block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate PEM\")\n\t\t}\n\t\tcert, err = x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/serviceaccount/claims.go#L63-L99","documentation":"ClaimSetWithX509 tried pem.Decode on restConfig.CertData and did not get a CERTIFICATE block, so the client certificate cannot be parsed into an identity. Fires in server auth when the server authenticates to Kubernetes with a client cert.","triggerScenarios":"Thrown at server/auth/serviceaccount/claims.go:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a valid PEM-encoded client certificate in the kubeconfig certData/certFile","Ensure the PEM block type is CERTIFICATE"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}