{"record":{"id":"b3fd6c4f513b71d6","repo":"apache/cassandra","slug":"invalid-certificate-format","errorCode":null,"errorMessage":"Invalid certificate format","messagePattern":"Invalid certificate format","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMReader.java","lineNumber":256,"sourceCode":"            throw new GeneralSecurityException(\"Invalid private key format\");\n        }\n    }\n\n    /**\n     * Parses the PEM formatted certificate/public-key based on the standard pattern specified by the\n     * <a href=\"https://datatracker.ietf.org/doc/html/rfc7468#section-13\">RFC 7468</a>.\n     *\n     * @param pemCerts certificate/public-key stored as PEM content\n     * @return list of base64 encoded certificates within the defined encapsulation boundaries by the above RFC\n     * @throws GeneralSecurityException in case any issue encountered parsing the certificate\n     */\n    private static List<String> extractBase64EncodedCerts(String pemCerts) throws GeneralSecurityException\n    {\n        List<String> certificateList = new ArrayList<>();\n        Matcher matcher = CERT_PATTERN.matcher(pemCerts);\n        if (!matcher.find())\n        {\n            throw new GeneralSecurityException(\"Invalid certificate format\");\n        }\n\n        for (int start = 0; matcher.find(start); start = matcher.end())\n        {\n            String certificate = matcher.group(1).replaceAll(\"\\\\s\", \"\");\n            certificateList.add(certificate);\n        }\n        return certificateList;\n    }\n\n    /**\n     * Decodes given input in Base64 format.\n     *\n     * @param base64Input input to be decoded\n     * @return byte[] containing decoded bytes\n     * @throws GeneralSecurityException in case it fails to decode the given base64 input\n     */\n    private static byte[] decodeBase64(String base64Input) throws GeneralSecurityException","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMReader.java#L238-L274","documentation":"extractBase64EncodedCerts matches the CERT_PATTERN regex for '-----BEGIN ... CERTIFICATE-----' ... '-----END ... CERTIFICATE-----' blocks per RFC 7468. If the input string contains no certificate block at all, this GeneralSecurityException is thrown. It indicates the supplied 'certificates' PEM content has no recognizable X.509 certificate.","triggerScenarios":"Calling PEMReader.extractCertificates(pemCerts) or base64EncodedCerts — typically from PEMBasedSslContextFactory when loading certificate_chain from cassandra.yaml — where the string is empty, holds a private key instead of a certificate, or uses a nonstandard/missing BEGIN CERTIFICATE header.","commonSituations":"Swapped key and certificate_chain values in cassandra.yaml; a certificate file exported in DER binary format rather than PEM; a config value containing only a public key ('BEGIN PUBLIC KEY') rather than a certificate; empty file after a failed cert-issuance/renewal; templating leaving an empty placeholder.","solutions":["Confirm the certificate file starts with '-----BEGIN CERTIFICATE-----' and ends with '-----END CERTIFICATE-----'","Check the key and certificate_chain settings are not swapped in the encryption options","Convert DER certificates to PEM: openssl x509 -inform der -in cert.der -out cert.pem","Include the full chain (intermediates) concatenated in PEM form if required","Verify the file is non-empty and readable by the Cassandra process; re-export from your CA if it is blank"],"exampleFix":"// before: DER certificate used directly\nopenssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.der   # DER output\n// after: ensure PEM output / convert existing DER\nopenssl x509 -inform der -in cert.der -out cert.pem   # '-----BEGIN CERTIFICATE-----'","handlingStrategy":"validation","validationCode":"// Check PEM certificate markers before calling the API\nstatic boolean looksLikePemCertificateChain(String pem) {\n    return pem != null && pem.contains(\"BEGIN CERTIFICATE\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Certificate[] certs = PEMReader.extractCertificates(pemCerts);\n} catch (GeneralSecurityException e) {\n    if (e.getMessage().contains(\"Invalid certificate format\")) {\n        logger.error(\"No BEGIN/END CERTIFICATE block found - check certificate_chain value in cassandra.yaml\");\n    }\n    throw e;\n}","preventionTips":["Keep certificates in PEM (base64) format, not DER binary; convert with openssl x509 -inform der","Concatenate the leaf and intermediate CA certs in order into a single PEM chain file","Check that key and certificate_chain settings are not swapped in the encryption config","Verify the cert file is non-empty after issuance/renewal automation runs"],"tags":["security","pem","certificate","x509"],"backgroundTag":"invalid-argument-format","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}