{"record":{"id":"fd0cbdb37fa29f34","repo":"hyperledger/fabric","slug":"getcertfrompem-error-failed-to-parse-x509-cert","errorCode":null,"errorMessage":"getCertFromPem error: failed to parse x509 cert","messagePattern":"getCertFromPem error: failed to parse x509 cert","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":191,"sourceCode":"\treturn thisMSP, nil\n}\n\nfunc (msp *bccspmsp) getCertFromPem(idBytes []byte) (*x509.Certificate, error) {\n\tif idBytes == nil {\n\t\treturn nil, errors.New(\"getCertFromPem error: nil idBytes\")\n\t}\n\n\t// Decode the pem bytes\n\tpemCert, _ := pem.Decode(idBytes)\n\tif pemCert == nil {\n\t\treturn nil, errors.Errorf(\"getCertFromPem error: could not decode pem bytes [%v]\", idBytes)\n\t}\n\n\t// get a cert\n\tvar cert *x509.Certificate\n\tcert, err := x509.ParseCertificate(pemCert.Bytes)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"getCertFromPem error: failed to parse x509 cert\")\n\t}\n\n\treturn cert, nil\n}\n\nfunc (msp *bccspmsp) getIdentityFromConf(idBytes []byte) (Identity, bccsp.Key, error) {\n\t// get a cert\n\tcert, err := msp.getCertFromPem(idBytes)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\t// get the public key in the right format\n\tcertPubK, err := msp.bccsp.KeyImport(cert, &bccsp.X509PublicKeyImportOpts{Temporary: true})\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L173-L209","documentation":"getCertFromPem wraps a failure from x509.ParseCertificate: the PEM wrapper decoded successfully, but the DER payload inside pemCert.Bytes is not a parseable X.509 certificate (truncated, corrupted, or a non-certificate PEM block such as a key or CRL).","triggerScenarios":"Placing a private key or CSR PEM where a certificate is expected; corrupted cert bytes; a PEM block of type CERTIFICATE whose payload was mangled (line wrapping/encoding damage).","commonSituations":"Copying admincerts from the wrong file (key instead of cert); text editors/email rewrapping long PEM lines; truncated certificates in a chain file.","solutions":["Validate the cert: openssl x509 -in cert.pem -text -noout; replace any file that fails","Ensure the PEM block type is CERTIFICATE (not PRIVATE KEY or CERTIFICATE REQUEST)","Re-copy the certificate from the issuing CA preserving exact PEM formatting"],"exampleFix":"// before\nidBytes = keyPEM // -----BEGIN PRIVATE KEY-----\n// after\nidBytes = certPEM // -----BEGIN CERTIFICATE-----","handlingStrategy":"validation","validationCode":"func validX509PEM(b []byte) error {\n    blk, _ := pem.Decode(b)\n    if blk == nil { return errors.New(\"not PEM\") }\n    if _, err := x509.ParseCertificate(blk.Bytes); err != nil { return fmt.Errorf(\"not an X.509 cert: %w\", err) }\n    return nil\n}","typeGuard":"func toX509Cert(b []byte) (*x509.Certificate, bool) {\n    blk, _ := pem.Decode(b)\n    if blk == nil { return nil, false }\n    c, err := x509.ParseCertificate(blk.Bytes)\n    return c, err == nil\n}","tryCatchPattern":"if err := msp.Setup(conf); err != nil && strings.Contains(err.Error(), \"failed to parse x509 cert\") {\n    return fmt.Errorf(\"replace the corrupt/mistyped certificate: %w\", err)\n}","preventionTips":["Run openssl x509 -text over every cert in the MSP tree during packaging","Never place private keys or CSRs in cert directories (cacerts/admincerts/signcerts)","Transfer certs in binary-safe ways (git, tar) to avoid line-wrapping corruption"],"tags":["msp","x509","certificate"],"backgroundTag":"x509-certificate-parse-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}