caddyserver/caddy · error

no CERTIFICATE pem block found in %s

Error message

no CERTIFICATE pem block found in %s

What it means

Error "no CERTIFICATE pem block found in %s" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/leaffileloader.go:89

		certs, err := x509.ParseCertificates(ders)
		if err != nil {
			return nil, err
		}
		certificates = append(certificates, certs...)
	}
	return certificates, nil
}

func convertPEMFilesToDERBytes(filename string) ([]byte, error) {
	certDataPEM, err := os.ReadFile(filename)
	if err != nil {
		return nil, err
	}
	var ders []byte
	// while block is not nil, we have more certificates in the file
	for block, rest := pem.Decode(certDataPEM); block != nil; block, rest = pem.Decode(rest) {
		if block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("no CERTIFICATE pem block found in %s", filename)
		}
		ders = append(
			ders,
			block.Bytes...,
		)
	}
	// if we decoded nothing, return an error
	if len(ders) == 0 {
		return nil, fmt.Errorf("no CERTIFICATE pem block found in %s", filename)
	}
	return ders, nil
}

// Interface guard
var (
	_ LeafCertificateLoader = (*LeafFileLoader)(nil)
	_ caddy.Provisioner     = (*LeafFileLoader)(nil)
	_ caddyfile.Unmarshaler = (*LeafFileLoader)(nil)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Ensure the file contains a PEM block of type CERTIFICATE.

When it happens

Trigger: Thrown at modules/caddytls/leaffileloader.go:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/1cfe80f5635b1b4a. Report an issue: GitHub.