caddyserver/caddy · error

no CERTIFICATE pem block found in the given pem data

Error message

no CERTIFICATE pem block found in the given pem data

What it means

Error "no CERTIFICATE pem block found in the given pem data" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/leafstorageloader.go:111

		ders, err := convertPEMToDER(certData)
		if err != nil {
			return nil, err
		}
		certs, err := x509.ParseCertificates(ders)
		if err != nil {
			return nil, err
		}
		certificates = append(certificates, certs...)
	}
	return certificates, nil
}

func convertPEMToDER(pemData []byte) ([]byte, error) {
	var ders []byte
	// while block is not nil, we have more certificates in the file
	for block, rest := pem.Decode(pemData); block != nil; block, rest = pem.Decode(rest) {
		if block.Type != "CERTIFICATE" {
			return nil, fmt.Errorf("no CERTIFICATE pem block found in the given pem data")
		}
		ders = append(
			ders,
			block.Bytes...,
		)
	}
	// if we decoded nothing, return an error
	if len(ders) == 0 {
		return nil, fmt.Errorf("no CERTIFICATE pem block found in the given pem data")
	}
	return ders, nil
}

// Interface guard
var (
	_ LeafCertificateLoader = (*LeafStorageLoader)(nil)
	_ caddy.Provisioner     = (*LeafStorageLoader)(nil)
)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Ensure the stored PEM data contains a CERTIFICATE block at the expected storage key.

When it happens

Trigger: Thrown at modules/caddytls/leafstorageloader.go:111 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/7613c94839fe9b6d. Report an issue: GitHub.