{"record":{"id":"a893c050731c2bbc","repo":"golang/go","slug":"tls-failed-to-parse-certificate-from-server-err","errorCode":null,"errorMessage":"tls: failed to parse certificate from server: {err}","messagePattern":"tls: failed to parse certificate from server: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client.go","lineNumber":1111,"sourceCode":"\t\tif max, err := strconv.Atoi(v); err == nil {\n\t\t\tif (n <= max) != (n <= defaultMaxRSAKeySize) {\n\t\t\t\ttlsmaxrsasize.IncNonDefault()\n\t\t\t}\n\t\t\treturn max, n <= max\n\t\t}\n\t}\n\treturn defaultMaxRSAKeySize, n <= defaultMaxRSAKeySize\n}\n\n// verifyServerCertificate parses and verifies the provided chain, setting\n// c.verifiedChains and c.peerCertificates or sending the appropriate alert.\nfunc (c *Conn) verifyServerCertificate(certificates [][]byte) error {\n\tcerts := make([]*x509.Certificate, len(certificates))\n\tfor i, asn1Data := range certificates {\n\t\tcert, err := globalCertCache.newCert(asn1Data)\n\t\tif err != nil {\n\t\t\tc.sendAlert(alertDecodeError)\n\t\t\treturn errors.New(\"tls: failed to parse certificate from server: \" + err.Error())\n\t\t}\n\t\tif cert.PublicKeyAlgorithm == x509.RSA {\n\t\t\tn := cert.PublicKey.(*rsa.PublicKey).N.BitLen()\n\t\t\tif max, ok := checkKeySize(n); !ok {\n\t\t\t\tc.sendAlert(alertBadCertificate)\n\t\t\t\treturn fmt.Errorf(\"tls: server sent certificate containing RSA key larger than %d bits\", max)\n\t\t\t}\n\t\t}\n\t\tcerts[i] = cert\n\t}\n\n\techRejected := c.config.EncryptedClientHelloConfigList != nil && !c.echAccepted\n\tif echRejected {\n\t\tif c.config.EncryptedClientHelloRejectionVerify != nil {\n\t\t\tif err := c.config.EncryptedClientHelloRejectionVerify(c.connectionStateLocked()); err != nil {\n\t\t\t\tc.sendAlert(alertBadCertificate)\n\t\t\t\treturn err\n\t\t\t}","sourceCodeStart":1093,"sourceCodeEnd":1129,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client.go#L1093-L1129","documentation":"Thrown in verifyServerCertificate() when the ASN.1/DER-encoded certificate bytes from the server's Certificate handshake message cannot be parsed into a valid x509.Certificate. The wrapped error string contains the specific x509 parse failure reason.","triggerScenarios":"Triggered when globalCertCache.newCert(asn1Data) returns a non-nil error for any certificate in the server's chain. The client sends alertDecodeError and returns the error with the underlying parse failure appended.","commonSituations":"Corrupted or truncated certificate data in transit. Server sending a non-X.509 certificate format. MITM proxy or TLS-terminating load balancer mangling certificate bytes. Network MTU issues truncating the handshake message. Server sending a certificate chain with invalid DER encoding.","solutions":["Inspect the full error string — the appended {err} describes the exact x509/ASN.1 parse failure (e.g. 'x509: malformed certificate').","Verify the server certificate with: openssl s_client -connect host:443 -showcerts","If behind a TLS-terminating proxy, ensure it correctly forwards the upstream certificate chain without modification.","Check for network corruption — test with a direct connection bypassing proxies or VPNs.","Try a different Go version — x509 parsing strictness has changed across releases."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Certificate parse errors are untyped — match by prefix\nconn, err := tls.Dial(\"tcp\", addr, config)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to parse certificate from server\") {\n        log.Printf(\"Server certificate is malformed or corrupted: %v\", err)\n        // Inspect with openssl s_client -connect host:443 -showcerts\n        // Check for proxy/MTU issues\n    }\n    return err\n}","preventionTips":["Use openssl s_client -showcerts to pre-validate server certificate chains before deploying clients.","Ensure TLS-terminating proxies forward certificates without modification.","Monitor for network corruption in environments with high packet loss."],"tags":["tls","go","certificate","x509","parsing"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}