{"record":{"id":"c41374197129c1de","repo":"ory/hydra","slug":"unable-to-base64-decode-the-tls-private-key-v","errorCode":null,"errorMessage":"unable to base64 decode the TLS private key: %v","messagePattern":"unable to base64 decode the TLS private key: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":80,"sourceCode":"\n- ` + prefix + `_CERT: Base64 encoded (without padding) string of the TLS certificate (PEM encoded) to be used for HTTP over TLS (HTTPS).\n\tExample: ` + prefix + `_CERT=\"-----BEGIN CERTIFICATE-----\\nMIIDZTCCAk2gAwIBAgIEV5xOtDANBgkqhkiG9w0BAQ0FADA0MTIwMAYDVQQDDClP...\"\n\n- ` + prefix + `_KEY: Base64 encoded (without padding) string of the private key (PEM encoded) to be used for HTTP over TLS (HTTPS).\n\tExample: ` + prefix + `_KEY=\"-----BEGIN ENCRYPTED PRIVATE KEY-----\\nMIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDg...\"\n`\n}\n\n// CertificateFromBase64 loads a TLS certificate from a base64-encoded string of\n// the PEM representations of the cert and key.\nfunc CertificateFromBase64(certBase64, keyBase64 string) (tls.Certificate, error) {\n\tcertPEM, err := base64.StdEncoding.DecodeString(certBase64)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unable to base64 decode the TLS certificate: %v\", err)\n\t}\n\tkeyPEM, err := base64.StdEncoding.DecodeString(keyBase64)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unable to base64 decode the TLS private key: %v\", err)\n\t}\n\tcert, err := tls.X509KeyPair(certPEM, keyPEM)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unable to load X509 key pair: %v\", err)\n\t}\n\treturn cert, nil\n}\n\n// [deprecated] Certificate returns a TLS Certificate by looking at its\n// arguments. If both certPEMBase64 and keyPEMBase64 are not empty and contain\n// base64-encoded PEM representations of a cert and key, respectively, that key\n// pair is returned. Otherwise, if certPath and keyPath point to PEM files, the\n// key pair is loaded from those. Returns ErrNoCertificatesConfigured if all\n// arguments are empty, and ErrInvalidCertificateConfiguration if the arguments\n// are inconsistent.\n//\n// This function is deprecated. Use CertificateFromBase64 or GetCertificate\n// instead.","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L62-L98","documentation":"CertificateFromBase64 decodes the base64-encoded private key PEM. This error is returned when the key string is not valid standard base64. The certificate decoded fine, but the key material is corrupted or not base64.","triggerScenarios":"Calling CertificateFromBase64 (directly or through Certificate/GetCertFunc) where certBase64 is valid but keyBase64 fails base64.StdEncoding.DecodeString — e.g. raw PEM key pasted, URL-safe base64, stray whitespace, or an empty/garbage key value.","commonSituations":"Only the key was re-generated/re-uploaded and pasted as raw PEM, env var containing the key got truncated, quoting issues in YAML/env files mangling the key string, or swapped cert/key order.","solutions":["Re-encode the key: `base64 -w0 key.pem` and use that exact output","Strip all whitespace/newlines from keyBase64 before decoding","Check the value is standard (not URL-safe) base64 and not the raw PEM block","Verify cert and key arguments are not swapped"],"exampleFix":"// before\nkeyB64 := \"-----BEGIN PRIVATE KEY-----\\n...\" // raw PEM\n// after\nkeyPEMBytes, _ := os.ReadFile(\"key.pem\")\nkeyB64 := base64.StdEncoding.EncodeToString(keyPEMBytes)","handlingStrategy":"validation","validationCode":"func isStdBase64(s string) bool {\n    _, err := base64.StdEncoding.DecodeString(s)\n    return err == nil\n}\n// run before CertificateFromBase64: isStdBase64(keyBase64)","typeGuard":null,"tryCatchPattern":"cert, err := tlsx.CertificateFromBase64(certB64, keyB64)\nif err != nil && strings.Contains(err.Error(), \"base64 decode the TLS private key\") {\n    log.Error(\"keyBase64 is not valid standard base64; re-encode with `base64 -w0 key.pem`\")\n    return err\n}","preventionTips":["Base64-encode the key with `base64 -w0 key.pem` at deploy time","Watch for env/YAML quoting that truncates or mangles the key","Keep cert and key values clearly named to avoid swapping them"],"tags":["tls","base64","private-key","configuration"],"backgroundTag":"invalid-base64-certificate","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}