argoproj/argo-workflows · error

failed to parse certificate PEM

Error message

failed to parse certificate PEM

What it means

ClaimSetWithX509 tried pem.Decode on restConfig.CertData and did not get a CERTIFICATE block, so the client certificate cannot be parsed into an identity. Fires in server auth when the server authenticates to Kubernetes with a client cert.

Source

Thrown at server/auth/serviceaccount/claims.go:81

	// note that the SA name can have a colon in it, although the rest cannot
	parts = strings.SplitN(claims.Subject, ":", 4)
	if len(parts) < 4 {
		return claims, nil
	}
	claims.ServiceAccountNamespace = parts[2]
	claims.ServiceAccountName = parts[3]

	return claims, nil
}

func ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {
	var cert *x509.Certificate
	var err error
	if len(restConfig.CertData) > 0 {
		// Decode certificate from memory data
		block, _ := pem.Decode(restConfig.CertData)
		if block == nil || block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("failed to parse certificate PEM")
		}
		cert, err = x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse certificate: %w", err)
		}
	} else {
		// Load certificate from file
		data, err := os.ReadFile(restConfig.CertFile)
		if err != nil {
			return nil, fmt.Errorf("failed to read certificate file: %w", err)
		}
		block, _ := pem.Decode(data)
		if block == nil || block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("failed to parse certificate PEM")
		}
		cert, err = x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse certificate: %w", err)

View on GitHub (pinned to 35bff19146)

Solutions

1. Provide a valid PEM-encoded client certificate in the kubeconfig certData/certFile
2. Ensure the PEM block type is CERTIFICATE

When it happens

Trigger: Thrown at server/auth/serviceaccount/claims.go:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/a3d270fe08c86bb1. Report an issue: GitHub.