{"record":{"id":"dba5b92b288912c7","repo":"hashicorp/packer","slug":"unsupported-pem-verifier-data","errorCode":null,"errorMessage":"unsupported PEM verifier data","messagePattern":"unsupported PEM verifier data","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_key.go","lineNumber":189,"sourceCode":"}\n\nfunc loadPEMPublicKey(contents []byte) (crypto.PublicKey, []byte, error) {\n\tblock, _ := pem.Decode(contents)\n\tif block == nil {\n\t\treturn nil, nil, fmt.Errorf(\"no PEM block found\")\n\t}\n\n\tif publicKey, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {\n\t\treturn publicKey, pem.EncodeToMemory(block), nil\n\t}\n\tif certificate, err := x509.ParseCertificate(block.Bytes); err == nil {\n\t\treturn certificate.PublicKey, pem.EncodeToMemory(block), nil\n\t}\n\tif privateKey, verifier, err := loadPEMPrivateKeyAsPublic(contents); err == nil {\n\t\treturn privateKey, verifier, nil\n\t}\n\n\treturn nil, nil, fmt.Errorf(\"unsupported PEM verifier data\")\n}\n\nfunc loadPEMPrivateKeyAsPublic(contents []byte) (crypto.PublicKey, []byte, error) {\n\tblock, _ := pem.Decode(contents)\n\tif block == nil {\n\t\treturn nil, nil, fmt.Errorf(\"no PEM block found\")\n\t}\n\n\tvar signer crypto.Signer\n\tif key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {\n\t\tvar ok bool\n\t\tsigner, ok = key.(crypto.Signer)\n\t\tif !ok {\n\t\t\treturn nil, nil, fmt.Errorf(\"private key does not implement crypto.Signer\")\n\t\t}\n\t} else if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {\n\t\tsigner = key\n\t} else if key, err := x509.ParseECPrivateKey(block.Bytes); err == nil {","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_key.go#L171-L207","documentation":"loadPEMPublicKey found a valid PEM block but its DER payload is none of the supported verifier inputs: it is not a PKIX public key, not an X.509 certificate, and not a parseable private key. The library has exhausted its supported formats and rejects the data outright.","triggerScenarios":"Calling LoadPEMVerifier/LoadPEMVerifierBytes with PEM blocks like '-----BEGIN CSR-----' (certificate request), '-----BEGIN X509 CRL-----', '-----BEGIN PKCS7-----', an encrypted 'ENCRYPTED PRIVATE KEY', or a corrupted DER body.","commonSituations":"Configuring a CSR where a public key was expected; passing a PKCS#7 chain file; using an encrypted private key without stripping the passphrase; passing a legacy key format (PVK, PFX extracted block) that Go's x509 parsers reject.","solutions":["Export the intended public key explicitly: 'openssl pkey -in key.pem -pubout -out verifier.pem' (yields BEGIN PUBLIC KEY).","If you intend certificate-based verification, provide the full X.509 certificate PEM ('BEGIN CERTIFICATE'), not a CSR or CRL.","Decrypt encrypted private keys before use: 'openssl pkcs8 -in enc.pem -out plain.pem'.","Sanity-check the payload with 'openssl asn1parse -in file.pem' to see what the DER actually contains."],"exampleFix":"// before\nv, err := attestation.LoadPEMVerifier(\"request.csr\") // unsupported PEM verifier data\n// after\n$ openssl req -in request.csr -pubkey -noout > verifier.pem\nv, err := attestation.LoadPEMVerifier(\"verifier.pem\")","handlingStrategy":"validation","validationCode":"raw, _ := os.ReadFile(path)\nblock, _ := pem.Decode(raw)\nif block == nil {\n\treturn fmt.Errorf(\"%s: no PEM block\", path)\n}\nif _, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {\n\treturn nil // PKIX public key: accepted\n}\nif _, err := x509.ParseCertificate(block.Bytes); err == nil {\n\treturn nil // certificate: accepted\n}\nreturn fmt.Errorf(\"%s: PEM payload is not a PKIX public key or X.509 certificate\", path)","typeGuard":null,"tryCatchPattern":"v, err := attestation.LoadPEMVerifier(path)\nif err != nil && strings.Contains(err.Error(), \"unsupported PEM verifier data\") {\n\treturn fmt.Errorf(\"%s must contain a PUBLIC KEY or CERTIFICATE; export with: openssl pkey -in key.pem -pubout -out verifier.pem\", path)\n}","preventionTips":["Use only 'BEGIN PUBLIC KEY' or 'BEGIN CERTIFICATE' files as verifier inputs; CSRs, CRLs, and PKCS#7 are rejected.","Derive verifier files from keys once at provisioning time with 'openssl pkey -pubout'.","Inspect unknown PEM payloads with 'openssl asn1parse' before configuring them.","Fail fast: load all verifiers during startup so bad files are caught before verification traffic."],"tags":["go","pem","x509","key-format"],"backgroundTag":"unsupported-key-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}