{"record":{"id":"b8a4fdcd4abf5367","repo":"go-sql-driver/mysql","slug":"no-pem-data-found-data-s-b8a4fd","errorCode":null,"errorMessage":"no Pem data found, data: %s","messagePattern":"no Pem data found, data: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth.go","lineNumber":463,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn mc.resultUnchanged().readResultOK()\n\n\t\t\tdefault:\n\t\t\t\treturn ErrMalformPkt\n\t\t\t}\n\t\tdefault:\n\t\t\treturn ErrMalformPkt\n\t\t}\n\n\tcase \"sha256_password\":\n\t\tswitch len(authData) {\n\t\tcase 0:\n\t\t\treturn nil // auth successful\n\t\tdefault:\n\t\t\tblock, _ := pem.Decode(authData)\n\t\t\tif block == nil {\n\t\t\t\treturn fmt.Errorf(\"no Pem data found, data: %s\", authData)\n\t\t\t}\n\n\t\t\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\t// send encrypted password\n\t\t\terr = mc.sendEncryptedPassword(oldAuthData, pub.(*rsa.PublicKey))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\treturn mc.resultUnchanged().readResultOK()\n\t\t}\n\n\tdefault:\n\t\treturn nil // auth successful\n\t}","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/03d76c7e07908e255ce62d126d07ede3f2365d86/auth.go#L445-L481","documentation":"Returned at auth.go:463 during sha256_password authentication: pem.Decode of the auth data returns nil, so the server's RSA public key (needed to encrypt the password on a non-TLS link) could not be parsed. Note the message capitalizes 'Pem' differently from the caching_sha2 variant (error 36).","triggerScenarios":"Authenticating with the sha256_password plugin (older MySQL 5.7 / MariaDB) over plaintext TCP without a pinned key, where the server's key payload is not valid PEM.","commonSituations":"sha256_password accounts behind a proxy that alters the auth payload; server/proxy incompatibility; MITM or corruption during the key exchange.","solutions":["Use TLS so the password is sent as cleartext over the encrypted channel (no RSA exchange).","Pin the server public key with serverPubKey to skip parsing a server-supplied key.","Make any intermediary fully transparent to the auth handshake.","Validate the server returns standards-compliant PEM key material."],"exampleFix":"// before: sha256_password over plaintext, key not PEM\ndsn := \"user:pass@tcp(mysql57:3306)/db\"\n// -> \"no Pem data found, data: ...\"\n\n// after: encrypt the transport\ndsn := \"user:pass@tcp(mysql57:3306)/db?tls=true\"","handlingStrategy":"fallback","validationCode":"// For sha256_password, use TLS or pin the key to skip PEM parsing.\nmysql.RegisterServerPubKey(\"mysql57\", serverKeyPEM)\ndsn := \"user:pass@tcp(host:3306)/db?tls=true\" // or ?serverPubKey=mysql57","typeGuard":"func isNoPemDataSha256(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"no Pem data found\")\n}","tryCatchPattern":"if isNoPemDataSha256(err) {\n    // switch to TLS, or pin serverPubKey, then retry.\n}","preventionTips":["Use TLS for sha256_password accounts on the network.","Pin the server public key when TLS is unavailable.","Keep proxies transparent to the auth handshake."],"tags":["authentication","sha256","pem","handshake"],"backgroundTag":null,"analyzedSha":"03d76c7e07908e255ce62d126d07ede3f2365d86","analyzedAt":"2026-08-07T10:39:17.340Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}