{"record":{"id":"f331eaea31e7f3c6","repo":"grafana/k6","slug":"failed-to-decode-certificate-pem-file","errorCode":null,"errorMessage":"failed to decode certificate PEM file","messagePattern":"failed to decode certificate PEM file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/crypto/x509/x509.go","lineNumber":149,"sourceCode":"\tif err != nil {\n\t\treturn Issuer{}, err\n\t}\n\treturn makeIssuer(parsed.Issuer), nil\n}\n\n// subject extracts certificate subject\nfunc (mi X509) subject(encoded []byte) Subject {\n\tparsed, err := parseCertificate(encoded)\n\tif err != nil {\n\t\tcommon.Throw(mi.vu.Runtime(), err)\n\t}\n\treturn makeSubject(parsed.Subject)\n}\n\nfunc parseCertificate(encoded []byte) (*x509.Certificate, error) {\n\tdecoded, _ := pem.Decode(encoded)\n\tif decoded == nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode certificate PEM file\")\n\t}\n\tparsed, err := x509.ParseCertificate(decoded.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t}\n\treturn parsed, nil\n}\n\nfunc makeCertificate(parsed *x509.Certificate) (Certificate, error) {\n\tpublicKey, err := makePublicKey(parsed.PublicKey)\n\tif err != nil {\n\t\treturn Certificate{}, err\n\t}\n\treturn Certificate{\n\t\tSubject:            makeSubject(parsed.Subject),\n\t\tIssuer:             makeIssuer(parsed.Issuer),\n\t\tNotBefore:          iso8601(parsed.NotBefore),\n\t\tNotAfter:           iso8601(parsed.NotAfter),","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/grafana/k6/blob/01ffac6f245854c1b8adc6a69857c76a15f90022/internal/js/modules/k6/crypto/x509/x509.go#L131-L167","documentation":"Returned by parseCertificate when pem.Decode returns a nil block — a sentinel guard (no %w, nothing to unwrap) meaning the input bytes contain no valid PEM block at all (wrong type, missing BEGIN/END markers, or non-PEM content). The input at fault is the encoded certificate bytes passed to x509.parse/altNames/issuer/subject, typically from open().pem.contents or a bundled PEM string in the script.","triggerScenarios":"Thrown at internal/js/modules/k6/crypto/x509/x509.go:149 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the file is actually PEM-formatted with proper BEGIN/END CERTIFICATE markers","Check for copy-paste damage (missing headers, line-wrap corruption, CRLF issues)","Confirm you are reading the certificate file and not a private key or DER-encoded file","If the certificate is DER-encoded, convert it to PEM first (e.g. openssl x509 -inform der -out pem)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ffac6f245854c1b8adc6a69857c76a15f90022","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}