{"record":{"id":"c95122d331c2fb40","repo":"hashicorp/packer","slug":"parse-fulcio-certificate-w","errorCode":null,"errorMessage":"parse Fulcio certificate: %w","messagePattern":"parse Fulcio certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":118,"sourceCode":"\tidToken, err := resolveAmbientIDToken(ctx, cfg.Env)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeypair, err := newKeylessEphemeralKeypair()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generate ephemeral keypair: %w\", err)\n\t}\n\n\tfulcio := newKeylessFulcio(fulcioURL)\n\tcertDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"request Fulcio certificate: %w\", err)\n\t}\n\n\tcertificate, err := x509.ParseCertificate(certDER)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parse Fulcio certificate: %w\", err)\n\t}\n\n\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})\n\tverifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create keyless verifier: %w\", err)\n\t}\n\n\treturn &keylessSigner{\n\t\tkeypair:  keypair,\n\t\tcertPEM:  certPEM,\n\t\tcert:     certificate,\n\t\tverifier: verifier,\n\t\tkeyID:    hex.EncodeToString(keypair.GetHint()),\n\t}, nil\n}\n\nfunc (s *keylessSigner) Sign(ctx context.Context, payloadType string, payload []byte) (Signature, error) {","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L100-L136","documentation":"This error wraps x509.ParseCertificate failing on the DER bytes returned by Fulcio's GetCertificate. The library throws it when the certificate provider returns data that is not a valid ASN.1/DER X.509 certificate — for example an error body, HTML, or a differently-encoded response from a misconfigured or incompatible Fulcio endpoint. It indicates the Fulcio response could not be interpreted as a certificate.","triggerScenarios":"newKeylessSigner (internal/attestation/sign_keyless.go:116-119) receives certDER from fulcio.GetCertificate and calls x509.ParseCertificate; error occurs when the returned bytes are not valid DER — e.g. the endpoint returned a JSON/HTML error payload the SDK passed through, or the Fulcio API version differs from what sigstore-go expects.","commonSituations":"A custom fulcio_url pointing at a proxy or mock that returns JSON/HTML instead of DER; an outdated sigstore-go SDK incompatible with a newer Fulcio response format; MITM/proxy injecting an error page; hitting the wrong port/path on a self-hosted Fulcio.","solutions":["Verify fulcio_url points directly at a real Fulcio instance (no HTML error pages); test the endpoint manually.","Upgrade github.com/sigstore/sigstore-go to the latest version so response parsing matches the current Fulcio API.","Inspect what the endpoint actually returns (curl the cert endpoint) to identify proxy/injection issues.","If using a self-hosted Fulcio, confirm it is a compatible version and serving the expected API routes."],"exampleFix":"// before\nfulcio_url = \"https://internal-proxy.example.com/fulcio\"  // returns HTML error page\n// after\nfulcio_url = \"https://fulcio.example.com\"  // direct Fulcio instance","handlingStrategy":"validation","validationCode":"// Verify the Fulcio endpoint serves the expected API before signing:\nresp, err := http.Get(fulcioURL + \"/api/v1/rootCert\")\nif err != nil {\n    return err\n}\nif ct := resp.Header.Get(\"Content-Type\"); strings.Contains(ct, \"text/html\") {\n    return fmt.Errorf(\"fulcio_url %s is not serving the Fulcio API\", fulcioURL)\n}","typeGuard":null,"tryCatchPattern":"signer, err := newKeylessSigner(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"parse Fulcio certificate\") {\n    // log the raw response from the Fulcio endpoint; fix URL or upgrade sigstore-go\n}","preventionTips":["Point fulcio_url at a real Fulcio instance, not a proxy, gateway error page, or wrong port.","Keep github.com/sigstore/sigstore-go current with the Fulcio API version in use.","Test self-hosted Fulcio deployments with a known-good client before production runs."],"tags":["x509","fulcio","certificate-parsing"],"backgroundTag":"invalid-certificate-payload","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}