{"record":{"id":"ba7c057c979f848f","repo":"caddyserver/caddy","slug":"parsing-certificate-v","errorCode":null,"errorMessage":"parsing certificate: %v","messagePattern":"parsing certificate: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":880,"sourceCode":"\t\t} else {\n\t\t\tcfg.ClientAuth = tls.RequireAnyClientCert\n\t\t}\n\t}\n\n\t// enforce CA verification by adding CA certs to the ClientCAs pool\n\tif clientauth.ca != nil {\n\t\tcfg.ClientCAs = clientauth.ca.CertPool()\n\t}\n\n\t// TODO: DEPRECATED: Only here for backwards compatibility.\n\t// If leaf cert is specified, enforce by adding a client auth module\n\tif len(clientauth.TrustedLeafCerts) > 0 {\n\t\tcaddy.Log().Named(\"tls.connection_policy\").Warn(\"trusted_leaf_certs is deprecated; use leaf verifier module instead\")\n\t\tvar trustedLeafCerts []*x509.Certificate\n\t\tfor _, clientCertString := range clientauth.TrustedLeafCerts {\n\t\t\tclientCert, err := decodeBase64DERCert(clientCertString)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing certificate: %v\", err)\n\t\t\t}\n\t\t\ttrustedLeafCerts = append(trustedLeafCerts, clientCert)\n\t\t}\n\t\tclientauth.verifiers = append(clientauth.verifiers, LeafCertClientAuth{trustedLeafCerts: trustedLeafCerts})\n\t}\n\n\t// if a custom verification function already exists, wrap it\n\tclientauth.existingVerifyPeerCert = cfg.VerifyPeerCertificate\n\tcfg.VerifyConnection = clientauth.verifyConnection\n\treturn nil\n}\n\n// verifyConnection is for use as a tls.Config.VerifyConnection callback\n// to do custom client certificate verification. It is intended for\n// installation only by clientauth.ConfigureTLSConfig().\n//\n// Unlike VerifyPeerCertificate, VerifyConnection is called on every\n// connection including resumed sessions, preventing session-resumption bypass.","sourceCodeStart":862,"sourceCodeEnd":898,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L862-L898","documentation":"While configuring TLS client verification, Caddy decodes each base64 DER cert in ClientAuthentication.TrustedLeafCerts (the deprecated trusted_leaf_certs option); if decodeBase64DERCert fails (bad base64 or non-X.509 DER bytes) this error wraps it. The field is deprecated — the log also emits a warning pointing you to leaf verifier modules.","triggerScenarios":"Putting a PEM string, a file path, or malformed base64 into the trusted_leaf_certs JSON array instead of base64-encoded DER; values that decode but are not parseable as X.509 certificates.","commonSituations":"Hand-building JSON configs with trust_leaf_certs copied from a PEM file; scripts that base64-encode the wrong input; migrating configs written for older Caddy versions.","solutions":["Prefer the modern equivalent: tls.client_auth.verifier.leaf with a leaf_cert_loader (inline cert or file) instead of trusted_leaf_certs","If you must keep the deprecated field, supply base64(STD) of the DER bytes: openssl x509 -in cert.pem -outform der | base64 -w0","Verify round-trip: echo <value> | base64 -d | openssl x509 -inform der -noout","Check for line breaks or whitespace corruption inside the base64 string in the JSON"],"exampleFix":"# before (deprecated + error-prone JSON)\n\"client_authentication\": {\n  \"trusted_leaf_certs\": [\"MIIB...pem-text...\"],\n  \"mode\": \"require_and_verify\"\n}\n\n# after (caddyfile)\nclient_auth {\n  mode require_and_verify\n  verifier leaf {\n    leaf_cert_file /etc/caddy/client-leaf.pem\n  }\n}","handlingStrategy":"validation","validationCode":"// Ensure a value is base64(DER) of an X.509 cert before putting it in trusted_leaf_certs\nfunc isBase64DERCert(s string) error {\n\tder, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s))\n\tif err != nil {\n\t\treturn err\n\t}\n\tif _, err := x509.ParseCertificate(der); err != nil {\n\t\treturn fmt.Errorf(\"not an X.509 DER cert: %w\", err)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Migrate off trusted_leaf_certs entirely — use verifier leaf with a loader","Encode with: openssl x509 -in cert.pem -outform der | base64 -w0","Never paste PEM text (dashes/headers) into the base64 field"],"tags":["tls","client-auth","deprecated","base64","certificate"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}