argoproj/argo-workflows · error

failed to parse certificate: %w

Error message

failed to parse certificate: %w

What it means

ClaimSetWithX509 builds auth claims from the client certificate embedded in a kube rest.Config. When inline CertData is present, it PEM-decodes the block and calls x509.ParseCertificate; if the DER bytes inside the PEM block are not a valid X.509 certificate, the underlying parse error is wrapped as 'failed to parse certificate: %w'. This guards against corrupt or non-certificate data being used for identity extraction.

Source

Thrown at server/auth/serviceaccount/claims.go:85

	}
	claims.ServiceAccountNamespace = parts[2]
	claims.ServiceAccountName = parts[3]

	return claims, nil
}

func ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {
	var cert *x509.Certificate
	var err error
	if len(restConfig.CertData) > 0 {
		// Decode certificate from memory data
		block, _ := pem.Decode(restConfig.CertData)
		if block == nil || block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("failed to parse certificate PEM")
		}
		cert, err = x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse certificate: %w", err)
		}
	} else {
		// Load certificate from file
		data, err := os.ReadFile(restConfig.CertFile)
		if err != nil {
			return nil, fmt.Errorf("failed to read certificate file: %w", err)
		}
		block, _ := pem.Decode(data)
		if block == nil || block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("failed to parse certificate PEM")
		}
		cert, err = x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse certificate: %w", err)
		}
	}

	if cert == nil {

View on GitHub (pinned to 35bff19146)

Solutions

1. Verify CertData is the exact base64 of a PEM CERTIFICATE block: run `base64 -d` on client-certificate-data from the kubeconfig and inspect with `openssl x509 -in cert.pem -text -noout`
2. Regenerate/extract the client cert from the kubeconfig with `kubectl config view --raw --minify --flatten -o jsonpath='{.users[0].user.client-certificate-data}' | base64 -d` and feed that bytes back
3. Confirm the PEM block type is CERTIFICATE and not PRIVATE KEY/CSR; swap in the correct artifact if not

Example fix

// before: CertData = base64 of a private key
restConfig.CertData = base64StdDecodedPrivateKeyPEM
// after: CertData = base64 of the client certificate
restConfig.CertData = base64StdDecoded(clientCertPEM)

block, _ := pem.Decode(restConfig.CertData)
if block == nil || block.Type != "CERTIFICATE" {
    return errors.New("CertData is not a PEM CERTIFICATE block")
}
if _, err := x509.ParseCertificate(block.Bytes); err != nil {
    return fmt.Errorf("CertData is not a valid X.509 certificate: %w", err)
}

func isPEMCertificate(data []byte) bool {
    block, _ := pem.Decode(data)
    return block != nil && block.Type == "CERTIFICATE"
}

When it happens

Trigger: restConfig.CertData is non-empty and pem.Decode succeeds on a CERTIFICATE-typed block, but x509.ParseCertificate rejects the DER payload — e.g. truncated bytes, an RSA/EC PRIVATE KEY block relabeled as CERTIFICATE, or a certificate format x509 does not support (e.g. some Ed25519/PKCS variants).

Common situations: Users base64-decode the kubeconfig client-certificate-data incorrectly (wrong key, double encoding), paste a CSR or private key instead of the cert, or copy/paste through a tool that mangles characters in the base64 body.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• --client-certificate and --client-key must be provided toget
• failed to read certificate file: %w
• failed to parse certificate
• failed to create certificate: %w
• request failed with: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/37ec79339329676c. Report an issue: GitHub.