caddyserver/caddy · error

failed parsing certificate chain: %w

Error message

failed parsing certificate chain: %w

What it means

Error "failed parsing certificate chain: %w" thrown in caddyserver/caddy.

Source

Thrown at modules/caddypki/crypto.go:50

func pemDecodeCertificate(pemDER []byte) (*x509.Certificate, error) {
	pemBlock, remaining := pem.Decode(pemDER)
	if pemBlock == nil {
		return nil, fmt.Errorf("no PEM block found")
	}
	if len(remaining) > 0 {
		return nil, fmt.Errorf("input contained more than a single PEM block")
	}
	if pemBlock.Type != "CERTIFICATE" {
		return nil, fmt.Errorf("expected PEM block type to be CERTIFICATE, but got '%s'", pemBlock.Type)
	}
	return x509.ParseCertificate(pemBlock.Bytes)
}

func pemDecodeCertificateChain(pemDER []byte) ([]*x509.Certificate, error) {
	chain, err := pemutil.ParseCertificateBundle(pemDER)
	if err != nil {
		return nil, fmt.Errorf("failed parsing certificate chain: %w", err)
	}

	return chain, nil
}

func pemEncodeCert(der []byte) ([]byte, error) {
	return pemEncode("CERTIFICATE", der)
}

func pemEncode(blockType string, b []byte) ([]byte, error) {
	var buf bytes.Buffer
	err := pem.Encode(&buf, &pem.Block{Type: blockType, Bytes: b})
	return buf.Bytes(), err
}

func trusted(cert *x509.Certificate) bool {
	chains, err := cert.Verify(x509.VerifyOptions{})
	return len(chains) > 0 && err == nil

View on GitHub (pinned to 50e54ee279)

Solutions

1. Ensure every certificate in the chain is valid X.509; the wrapped error identifies the failing certificate.

When it happens

Trigger: Thrown at modules/caddypki/crypto.go:50 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/0bb9e8665f3ea475. Report an issue: GitHub.