argoproj/argo-workflows · warning

failed to parse certificate

Error message

failed to parse certificate

What it means

Defensive final check in ClaimSetWithX509: after both branches (CertData and CertFile), if the cert variable is still nil this generic error is returned. It should be unreachable in practice because each branch already returns earlier on PEM/parse failures; it acts as a safety net for future code changes that add new branches without setting cert.

Source

Thrown at server/auth/serviceaccount/claims.go:104

		}
	} else {
		// Load certificate from file
		data, err := os.ReadFile(restConfig.CertFile)
		if err != nil {
			return nil, fmt.Errorf("failed to read certificate file: %w", err)
		}
		block, _ := pem.Decode(data)
		if block == nil || block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("failed to parse certificate PEM")
		}
		cert, err = x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse certificate: %w", err)
		}
	}

	if cert == nil {
		return nil, fmt.Errorf("failed to parse certificate")
	}

	// Extract username from CommonName (CN)
	username := cert.Subject.CommonName

	// Extract group information from Organization (O) fields
	var groups []string
	for _, org := range cert.Subject.Organization {
		if strings.HasPrefix(org, "system:") {
			groups = append(groups, org)
		}
	}

	// Construct claims object
	claims := &types.Claims{
		Claims: jwt.Claims{
			Subject: username,
			Issuer:  "kubernetes/cert",

View on GitHub (pinned to 35bff19146)

Solutions

1. If you see it after a code change, audit every branch of ClaimSetWithX509 and ensure each assigns `cert` or returns an error
2. Add a unit test covering all certificate-source branches (CertData, CertFile) so nil-cert paths fail in CI
3. Treat any occurrence as an internal bug; file it with the argo-workflows version and the rest.Config source

Example fix

// before (new branch leaves cert unset)
if someNewSource {
    // parsed but forgot: cert = parsedCert
}
// after
if someNewSource {
    cert = parsedCert
}

claims, err := ClaimSetWithX509(restConfig)
if err != nil && err.Error() == "failed to parse certificate" {
    // internal invariant broken; report a bug with the argo-workflows version
}

When it happens

Trigger: Theoretically unreachable with current code: it would require both branches to complete without assigning cert. Hits maintainers who modify ClaimSetWithX509 and add a code path that leaves cert nil, or when the function is refactored.

Common situations: Developers extending the function (e.g. adding a new certificate source) forget to assign cert in their branch; users will effectively never see this directly — they'd see the earlier, more specific PEM/parse errors instead.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to parse certificate: %w
• --client-certificate and --client-key must be provided toget
• AuthSupplier cannot be empty when connecting to Argo Server
• must specify at least one auth mode
• failed to marshall claims: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/1d594667b4423d6d. Report an issue: GitHub.