caddyserver/caddy · error

parsing certificate '%s': %v

Error message

parsing certificate '%s': %v

What it means

A storage-backed trust pool found a PEM block of type CERTIFICATE at the given storage key, but x509.ParseCertificate failed to parse its DER bytes. The data at that key is not a valid X.509 certificate even though it is PEM-framed.

Source

Thrown at modules/caddytls/capools.go:444

	for _, caID := range ca.PEMKeys {
		bs, err := ca.storage.Load(ctx, caID)
		if err != nil {
			return fmt.Errorf("error loading cert '%s' from storage: %s", caID, err)
		}
		// Parse PEM to extract certificates
		pemData := bs
		for len(pemData) > 0 {
			var block *pem.Block
			block, pemData = pem.Decode(pemData)
			if block == nil {
				break
			}
			if block.Type != "CERTIFICATE" {
				continue
			}
			cert, err := x509.ParseCertificate(block.Bytes)
			if err != nil {
				return fmt.Errorf("parsing certificate '%s': %v", caID, err)
			}
			caPool.AddCert(cert)
			certs = append(certs, cert)
		}
	}
	ca.pool = caPool
	ca.certs = certs

	return nil
}

// Syntax:
//
//	trust_pool storage [<storage_keys>...] {
//		storage <storage_module>
//		keys	<storage_keys>...
//	}
//

View on GitHub (pinned to 50e54ee279)

Solutions

1. Inspect the object at the failing key with `openssl x509 -in file.pem -noout -text` to confirm it parses.
2. Replace the corrupt blob with the correct certificate PEM and reload Caddy.
3. If the PEM intentionally contains non-cert blocks, note only CERTIFICATE blocks are parsed — make sure at least the real cert is intact.

Example fix

# before (storage object contains truncated PEM)
-----BEGIN CERTIFICATE-----
MIIB...truncated

# after (valid full certificate)
-----BEGIN CERTIFICATE-----
MIIB...full base64...
-----END CERTIFICATE-----

// validate a PEM blob parses as X.509 before uploading to storage
func validPEMCerts(data []byte) error {
	rest := data
	for {
		var block *pem.Block
		block, rest = pem.Decode(rest)
		if block == nil {
			break
		}
		if block.Type != "CERTIFICATE" {
			continue
		}
		if _, err := x509.ParseCertificate(block.Bytes); err != nil {
			return fmt.Errorf("bad certificate block: %w", err)
		}
	}
	return nil
}

When it happens

Trigger: The stored blob contains a malformed or truncated certificate, a PEM CERTIFICATE block wrapping non-certificate DER (e.g. a CSR or garbage), or a corrupted upload.

Common situations: Manually pasted certificates with copy/paste damage; base64 payload truncated; wrong file uploaded to the storage key (e.g. a key or CSR saved as .pem).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• parsing certificate from URL %s: %v
• CA %s has no root certificate
• CA %s has a nil certificate in its intermediate chain
• WebSocket connections aren't allowed.
• Disabling same-origin restrictions is not allowed.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/6af14e2979e5fa61. Report an issue: GitHub.