{"record":{"id":"ea087ce4638d5fcf","repo":"cloudflare/cloudflared","slug":"unknown-block-s-in-the-certificate","errorCode":null,"errorMessage":"unknown block %s in the certificate","messagePattern":"unknown block (.+?) in the certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/origin_cert.go","lineNumber":101,"sourceCode":"func decodeOriginCert(blocks []byte) (*OriginCert, error) {\n\tif len(blocks) == 0 {\n\t\treturn nil, fmt.Errorf(\"cannot decode empty certificate\")\n\t}\n\toriginCert := OriginCert{}\n\tblock, rest := pem.Decode(blocks)\n\tfor block != nil {\n\t\tswitch block.Type {\n\t\tcase \"PRIVATE KEY\", \"CERTIFICATE\":\n\t\t\t// this is for legacy purposes.\n\t\tcase \"ARGO TUNNEL TOKEN\":\n\t\t\tif originCert.ZoneID != \"\" || originCert.APIToken != \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"found multiple tokens in the certificate\")\n\t\t\t}\n\t\t\t// The token is a string,\n\t\t\t// Try the newer JSON format\n\t\t\t_ = json.Unmarshal(block.Bytes, &originCert)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unknown block %s in the certificate\", block.Type)\n\t\t}\n\t\tblock, rest = pem.Decode(rest)\n\t}\n\n\tif originCert.ZoneID == \"\" || originCert.APIToken == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing token in the certificate\")\n\t}\n\n\treturn &originCert, nil\n}\n\nfunc readOriginCert(originCertPath string) ([]byte, error) {\n\toriginCert, err := os.ReadFile(originCertPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot read %s to load origin certificate\", originCertPath)\n\t}\n\n\treturn originCert, nil","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/credentials/origin_cert.go#L83-L119","documentation":"Certificate-parsing error in decodeOriginCert: a PEM block in the origin cert file has a type other than 'PRIVATE KEY', 'CERTIFICATE', or 'ARGO TUNNEL TOKEN', i.e. the file contains unexpected material that the loader does not know how to interpret.","triggerScenarios":"PEM bundle contains a block whose Type is none of the three allowed, e.g. 'EC PRIVATE KEY', 'RSA PRIVATE KEY', 'ENCRYPTED PRIVATE KEY', or an arbitrary labeled block.","commonSituations":"User pasted a full openssl-generated key (legacy PEM header) into the origin cert; cert file mixed with unrelated material; editor mangled headers.","solutions":["Inspect the PEM headers in the file and remove blocks with unexpected types","Convert legacy keys to PKCS#8 ('BEGIN PRIVATE KEY') if a key must be bundled","Re-run 'cloudflared tunnel login' to get a pristine cert.pem"],"exampleFix":"// before (file contains '-----BEGIN RSA PRIVATE KEY-----')\n// after: openssl pkcs8 -topk8 -in key.pem -out key.pkcs8.pem","handlingStrategy":"validation","validationCode":"rest := pemBytes\nfor {\n\tb, r := pem.Decode(rest)\n\tif b == nil { break }\n\tswitch b.Type {\n\tcase \"PRIVATE KEY\", \"CERTIFICATE\", \"ARGO TUNNEL TOKEN\":\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported PEM block %q\", b.Type)\n\t}\n\trest = r\n}","typeGuard":null,"tryCatchPattern":"cert, err := credentials.DecodeOriginCert(blocks)\nif err != nil && strings.HasPrefix(err.Error(), \"unknown block\") {\n\t// strip offending block or regenerate cert\n}","preventionTips":["Only bundle PKCS#8 'PRIVATE KEY', 'CERTIFICATE', and 'ARGO TUNNEL TOKEN' blocks","Convert legacy RSA/EC PEM keys to PKCS#8 before bundling","Never paste unrelated certs/keys into cert.pem"],"tags":["pem","certificate","parsing"],"backgroundTag":"schema-validation-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}