caddyserver/caddy · error

failed to decode root certificate: %v

Error message

failed to decode root certificate: %v

What it means

Error "failed to decode root certificate: %v" thrown in caddyserver/caddy.

Source

Thrown at modules/caddypki/command.go:227

	// Make the request to fetch the CA info
	resp, err := caddycmd.AdminAPIRequest(adminAddr, http.MethodGet, uri, make(http.Header), nil)
	if err != nil {
		return nil, fmt.Errorf("requesting CA info: %v", err)
	}
	defer resp.Body.Close()

	// Decode the response
	caInfo := new(caInfo)
	err = json.NewDecoder(resp.Body).Decode(caInfo)
	if err != nil {
		return nil, fmt.Errorf("failed to decode JSON response: %v", err)
	}

	// Decode the root cert
	rootBlock, _ := pem.Decode([]byte(caInfo.RootCert))
	if rootBlock == nil {
		return nil, fmt.Errorf("failed to decode root certificate: %v", err)
	}
	rootCert, err := x509.ParseCertificate(rootBlock.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed to parse root certificate: %v", err)
	}

	return rootCert, nil
}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Ensure the CA certificate data returned is valid PEM; check the server and CA configuration.

When it happens

Trigger: Thrown at modules/caddypki/command.go:227 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/e01d9eff3aaa36e9. Report an issue: GitHub.