{"record":{"id":"f83563cbcd655d3f","repo":"ory/hydra","slug":"unable-to-base64-decode-the-tls-certificate-v","errorCode":null,"errorMessage":"unable to base64 decode the TLS certificate: %v","messagePattern":"unable to base64 decode the TLS certificate: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":76,"sourceCode":"\tExample: ` + prefix + `_CERT_PATH=~/cert.pem\n\n- ` + prefix + `_KEY_PATH: The path to the TLS private key (pem encoded).\n\tExample: ` + prefix + `_KEY_PATH=~/key.pem\n\n- ` + prefix + `_CERT: Base64 encoded (without padding) string of the TLS certificate (PEM encoded) to be used for HTTP over TLS (HTTPS).\n\tExample: ` + prefix + `_CERT=\"-----BEGIN CERTIFICATE-----\\nMIIDZTCCAk2gAwIBAgIEV5xOtDANBgkqhkiG9w0BAQ0FADA0MTIwMAYDVQQDDClP...\"\n\n- ` + prefix + `_KEY: Base64 encoded (without padding) string of the private key (PEM encoded) to be used for HTTP over TLS (HTTPS).\n\tExample: ` + prefix + `_KEY=\"-----BEGIN ENCRYPTED PRIVATE KEY-----\\nMIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDg...\"\n`\n}\n\n// CertificateFromBase64 loads a TLS certificate from a base64-encoded string of\n// the PEM representations of the cert and key.\nfunc CertificateFromBase64(certBase64, keyBase64 string) (tls.Certificate, error) {\n\tcertPEM, err := base64.StdEncoding.DecodeString(certBase64)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unable to base64 decode the TLS certificate: %v\", err)\n\t}\n\tkeyPEM, err := base64.StdEncoding.DecodeString(keyBase64)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unable to base64 decode the TLS private key: %v\", err)\n\t}\n\tcert, err := tls.X509KeyPair(certPEM, keyPEM)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unable to load X509 key pair: %v\", err)\n\t}\n\treturn cert, nil\n}\n\n// [deprecated] Certificate returns a TLS Certificate by looking at its\n// arguments. If both certPEMBase64 and keyPEMBase64 are not empty and contain\n// base64-encoded PEM representations of a cert and key, respectively, that key\n// pair is returned. Otherwise, if certPath and keyPath point to PEM files, the\n// key pair is loaded from those. Returns ErrNoCertificatesConfigured if all\n// arguments are empty, and ErrInvalidCertificateConfiguration if the arguments","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L58-L94","documentation":"CertificateFromBase64 decodes base64-encoded PEM blobs for a TLS cert and key. This error is returned when the certificate string is not valid base64 (base64.StdEncoding.DecodeString fails), before any PEM parsing happens. It means the supplied cert material is corrupted or not base64-encoded at all.","triggerScenarios":"Calling CertificateFromBase64(certBase64, keyBase64) (directly or via Certificate/GetCertFunc when TLS_CERT and TLS_KEY style base64 inputs are configured) with a cert string containing whitespace/newlines in the wrong place, URL-safe base64 instead of standard base64, or a raw PEM block (-----BEGIN CERTIFICATE-----) instead of base64 of the PEM.","commonSituations":"Pasting the PEM file itself instead of base64-encoding it, using `openssl base64` variants that insert line breaks not stripped correctly, env var values with surrounding quotes or trailing newline, or swapping cert/key values.","solutions":["Re-encode the cert with base64.StdEncoding: `base64 -w0 cert.pem` and use that exact string","Strip whitespace/newlines from the value before use (strings map or base64.NewDecoder with StdEncoding after cleanup)","Verify you are not passing URL-safe base64; convert it to standard base64 if so","Confirm cert and key values are not swapped"],"exampleFix":"// before\ncertB64 := \"-----BEGIN CERTIFICATE-----\\nMIIB...\" // raw PEM, not base64\ncert, err := CertificateFromBase64(certB64, keyB64)\n// after\ncertPEM, _ := os.ReadFile(\"cert.pem\")\ncertB64 := base64.StdEncoding.EncodeToString(certPEM)\ncert, err := CertificateFromBase64(certB64, keyB64)","handlingStrategy":"validation","validationCode":"func isStdBase64(s string) bool {\n    _, err := base64.StdEncoding.DecodeString(s)\n    return err == nil\n}\n// run before CertificateFromBase64: isStdBase64(certBase64)","typeGuard":null,"tryCatchPattern":"cert, err := tlsx.CertificateFromBase64(certB64, keyB64)\nif err != nil && strings.Contains(err.Error(), \"base64 decode the TLS certificate\") {\n    // strip whitespace / re-encode and retry once\n    cleaned := strings.Map(func(r rune) rune { if r == '\\n' || r == '\\r' || r == ' ' { return -1 }; return r }, certB64)\n    cert, err = tlsx.CertificateFromBase64(cleaned, keyB64)\n}","preventionTips":["Generate values with `base64 -w0 cert.pem` (standard, no line breaks)","Never paste raw PEM contents where base64 is expected","Trim whitespace/newlines from env-provided values"],"tags":["tls","base64","certificate","configuration"],"backgroundTag":"invalid-base64-certificate","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}