{"record":{"id":"f1bb6f27e3641cf3","repo":"ory/hydra","slug":"square-go-jose-parse-error-got-s-s-and","errorCode":null,"errorMessage":"square/go-jose: parse error, got '%s', '%s' and '%s'","messagePattern":"square/go-jose: parse error, got '(.+?)', '(.+?)' and '(.+?)'","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/josex/utils.go","lineNumber":69,"sourceCode":"\t}\n\n\t// Try to load SubjectPublicKeyInfo\n\tpub, err0 := x509.ParsePKIXPublicKey(input)\n\tif err0 == nil {\n\t\treturn pub, nil\n\t}\n\n\tcert, err1 := x509.ParseCertificate(input)\n\tif err1 == nil {\n\t\treturn cert.PublicKey, nil\n\t}\n\n\tjwk, err2 := LoadJSONWebKey(data, true)\n\tif err2 == nil {\n\t\treturn jwk, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"square/go-jose: parse error, got '%s', '%s' and '%s'\", err0, err1, err2)\n}\n\n// LoadPrivateKey loads a private key from PEM/DER/JWK-encoded data.\nfunc LoadPrivateKey(data []byte) (interface{}, error) {\n\tinput := data\n\n\tblock, _ := pem.Decode(data)\n\tif block != nil {\n\t\tinput = block.Bytes\n\t}\n\n\tvar priv interface{}\n\tpriv, err0 := x509.ParsePKCS1PrivateKey(input)\n\tif err0 == nil {\n\t\treturn priv, nil\n\t}\n\n\tpriv, err1 := x509.ParsePKCS8PrivateKey(input)","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/josex/utils.go#L51-L87","documentation":"LoadPublicKey tries to parse the input bytes three ways: as PEM (ParsePKIXPublicKey), as DER, and as a JWK (LoadJSONWebKey). If all three fail, it aggregates the three errors into this single parse-error message.","triggerScenarios":"Calling josex.LoadPublicKey with data that is none of PEM PKIX public key, DER public key, or JWK JSON — e.g. a private-key PEM, a raw base64 key, an x509 certificate instead of a public key, or truncated/garbled bytes.","commonSituations":"Pointing config at a private key file when a public key is required; pasting a certificate (-----BEGIN CERTIFICATE-----) instead of -----BEGIN PUBLIC KEY-----; wrong env var or file mounted empty; whitespace/BOM corruption.","solutions":["Inspect err0/err1/err2 in the message — they show exactly why PEM, DER, and JWK parsing each failed","Ensure the input is a PEM 'BEGIN PUBLIC KEY' block, raw DER SPKI bytes, or a JWK JSON object","If you have a certificate, extract its public key first (x509 cert .PublicKey) or use a loader that accepts certificates","If you only have a private key, derive the public key from it and pass that","Verify the file/env value is non-empty and not truncated"],"exampleFix":"// before\ndata, _ := os.ReadFile(\"server.key\") // private key PEM\njwk, err := josex.LoadPublicKey(data)\n// after\ndata, _ := os.ReadFile(\"server.pub\") // PEM PUBLIC KEY\njwk, err := josex.LoadPublicKey(data)","handlingStrategy":"validation","validationCode":"func looksLikePublicKey(data []byte) error {\n    s := strings.TrimSpace(string(data))\n    switch {\n    case strings.HasPrefix(s, \"-----BEGIN PUBLIC KEY-----\"),\n        strings.HasPrefix(s, \"{\\\"kty\\\"\"):\n        return nil\n    case strings.HasPrefix(s, \"-----BEGIN CERTIFICATE-----\"):\n        return errors.New(\"got a certificate; extract the public key first\")\n    case strings.Contains(s, \"PRIVATE KEY\"):\n        return errors.New(\"got a private key; LoadPublicKey needs the public key\")\n    default:\n        return errors.New(\"input is neither PEM PUBLIC KEY nor JWK JSON\")\n    }\n}","typeGuard":"func isPEMPublicKey(data []byte) bool {\n    return strings.HasPrefix(strings.TrimSpace(string(data)), \"-----BEGIN PUBLIC KEY-----\")\n}\nfunc isJWK(data []byte) bool {\n    return json.Valid(data) && strings.Contains(string(data), \"\\\"kty\\\"\")\n}","tryCatchPattern":"jwk, err := josex.LoadPublicKey(data)\nif err != nil {\n    return fmt.Errorf(\"invalid public key material: %w\", err)\n}","preventionTips":["Store keys as PEM PUBLIC KEY or JWK files and name files accordingly (.pub vs .key)","Never feed certificates where plain public keys are expected","Check the mounted file/env var is non-empty at startup","Log the first bytes of the input when key loading fails to spot wrong formats"],"tags":["jose","jwk","pem","key-parsing","go"],"backgroundTag":"key-parse-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}