{"record":{"id":"f9ee7a3b89c49415","repo":"cloudflare/pingora","slug":"failed-to-parse-certificate-from-der-format-f9ee7a","errorCode":null,"errorMessage":"Failed to parse certificate from DER format.","messagePattern":"Failed to parse certificate from DER format\\.","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pingora-core/src/utils/tls/s2n.rs","lineNumber":57,"sourceCode":"    get_organization_x509(x509cert.borrow_cert())\n}\n\n/// Return the organization associated with the X509 certificate.\n/// see https://en.wikipedia.org/wiki/X.509#Structure_of_a_certificate\npub fn get_organization_x509(x509cert: &X509Certificate<'_>) -> Option<String> {\n    x509cert\n        .subject\n        .iter_organization()\n        .filter_map(|a| a.as_str().ok())\n        .map(|a| a.to_string())\n        .reduce(|cur, next| cur + &next)\n}\n\n/// Return the organization associated with the X509 certificate (as bytes).\n/// see https://en.wikipedia.org/wiki/X.509#Structure_of_a_certificate\npub fn get_organization_serial_bytes(cert: &[u8]) -> Result<(Option<String>, String)> {\n    let (_, x509cert) = x509_parser::certificate::X509Certificate::from_der(cert)\n        .expect(\"Failed to parse certificate from DER format.\");\n\n    get_organization_serial_x509(&x509cert)\n}\n\n/// Return the organization unit associated with the X509 certificate.\n/// see https://en.wikipedia.org/wiki/X.509#Structure_of_a_certificate\npub fn get_organization_unit(x509cert: &WrappedX509) -> Option<String> {\n    x509cert\n        .borrow_cert()\n        .subject\n        .iter_organizational_unit()\n        .filter_map(|a| a.as_str().ok())\n        .map(|a| a.to_string())\n        .reduce(|cur, next| cur + &next)\n}\n\n/// Get a combination of the common names for the given certificate\n/// see https://en.wikipedia.org/wiki/X.509#Structure_of_a_certificate","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/cloudflare/pingora/blob/0046038bd402bc82912da862dadf9a479f31e9f1/pingora-core/src/utils/tls/s2n.rs#L39-L75","documentation":"The s2n-tls backend's twin of the rustls helper: get_organization_serial_bytes() parses a DER-encoded X509 certificate with x509-parser and expects success. It panics when the input bytes are not a complete valid DER certificate — PEM/base64 passed where raw DER is required, or truncated/corrupted bytes.","triggerScenarios":"Calling pingora's s2n TLS utils get_organization_serial_bytes(cert_bytes) (cert org/serial extraction) with bytes that are PEM text, base64, truncated, or otherwise not strict DER. Only applies to builds using the s2n TLS feature.","commonSituations":"Same file fed to both DER- and PEM-expecting code paths; cert bytes sliced from the wrong offset in a chain buffer; corruption from secrets injection; empty file from a failed volume mount.","solutions":["Convert to DER first: `openssl x509 -in cert.pem -outform DER -out cert.der`","Pre-check with `openssl x509 -inform DER -in cert.der -noout` before calling the helper","If starting from PEM, decode the CERTIFICATE block payload yourself and pass those bytes","Verify integrity (size/checksum) if the bytes travel through config systems"],"exampleFix":"// before: PEM bytes passed to the s2n helper — panics\nlet (org, serial) = get_organization_serial_bytes(&pem_bytes);\n\n// after: pass the decoded DER contents of the PEM block\nuse x509_parser::pem::Pem;\nlet pem = Pem::iter_from_buffer(&pem_bytes).next().unwrap().unwrap();\nlet (org, serial) = get_organization_serial_bytes(&pem.contents);","handlingStrategy":"validation","validationCode":"fn is_valid_der_cert(bytes: &[u8]) -> bool {\n    x509_parser::certificate::X509Certificate::from_der(bytes).is_ok()\n}\n\n// gate the s2n helper call\nanyhow::ensure!(\n    is_valid_der_cert(&cert_bytes),\n    \"certificate is not valid DER (s2n get_organization_serial_bytes will panic)\"\n);","typeGuard":"fn is_der_cert(bytes: &[u8]) -> bool {\n    bytes.first() == Some(&0x30)\n        && x509_parser::certificate::X509Certificate::from_der(bytes).is_ok()\n}","tryCatchPattern":"let res = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n    get_organization_serial_bytes(&cert_bytes)\n}));\nif res.is_err() { /* log the offending cert and skip org/serial extraction */ }","preventionTips":["Convert PEM to DER at the pipeline boundary and pass only DER downstream","Validate certs during config load in the s2n build just as in the rustls build","Check file integrity (size/checksum) when certs flow through config systems"],"tags":["rust","pingora","tls","s2n","x509","certificate","der","parsing","panic"],"backgroundTag":"certificate-parsing-failed","analyzedSha":"0046038bd402bc82912da862dadf9a479f31e9f1","analyzedAt":"2026-08-16T21:33:22.341Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}