bytebase/bytebase · error

no valid CERTIFICATE PEM block found

Error message

no valid CERTIFICATE PEM block found

What it means

validateInlineCAPEM appends the provided data to an x509.CertPool; AppendCertsFromPEM returns false when no valid CERTIFICATE PEM block is present, and the code turns that into this error. The ssl_ca value must contain at least one parseable PEM certificate.

Source

Thrown at backend/api/v1/instance_service.go:633

		}
	}
	if ds.GetSslCert() != "" && ds.GetSslKey() == "" {
		if err := validateInlineCertPEM([]byte(ds.GetSslCert())); err != nil {
			return errors.Wrap(err, "invalid ssl_cert PEM")
		}
	}
	if ds.GetSslKey() != "" && ds.GetSslCert() == "" {
		if err := validateInlineKeyPEM([]byte(ds.GetSslKey())); err != nil {
			return errors.Wrap(err, "invalid ssl_key PEM")
		}
	}
	return nil
}

func validateInlineCAPEM(data []byte) error {
	pool := x509.NewCertPool()
	if ok := pool.AppendCertsFromPEM(data); !ok {
		return errors.New("no valid CERTIFICATE PEM block found")
	}
	return nil
}

func validateInlineCertPEM(data []byte) error {
	var certs [][]byte
	for {
		var block *pem.Block
		block, data = pem.Decode(data)
		if block == nil {
			break
		}
		if block.Type == "CERTIFICATE" {
			certs = append(certs, block.Bytes)
		}
	}
	if len(certs) == 0 {
		return errors.New("no CERTIFICATE PEM block found")

View on GitHub (pinned to 1870550677)

Solutions

1. Supply the CA as PEM format including the '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' lines.
2. Convert DER to PEM (openssl x509 -inform der -in ca.der -out ca.pem) and re-submit.
3. Verify the field contains the CA certificate, not a key or the leaf certificate chain alone with corruption.

Example fix

// before
sslCa: "MIIDdzCCAl+g..." // raw base64 DER
// after
sslCa: "-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+g...\n-----END CERTIFICATE-----"

function isPemCertificate(v) {
  return typeof v === 'string' && v.includes('-----BEGIN CERTIFICATE-----');
}
if (!isPemCertificate(ds.sslCa)) throw new Error('ssl_ca must be PEM');

const isPemCertificate = (v) => typeof v === 'string' && /-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----/.test(v);

When it happens

Trigger: CreateInstance/UpdateInstance/AddDataSource/UpdateDataSource with inline ssl_ca that is raw DER, truncated, JSON-escaped, or otherwise contains no '-----BEGIN CERTIFICATE-----' block.

Common situations: Pasting a base64 DER cert instead of PEM; copying the CA from a Windows cert export in DER form; whitespace/line-ending corruption when pasting; uploading a private key file into the CA field.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no CERTIFICATE PEM block found
• no PRIVATE KEY PEM block found
• invalid ssl_ca PEM
• invalid ssl_cert PEM
• ssl_cert and ssl_key must be both set or unset

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/90532fa11ac39abc. Report an issue: GitHub.