caddyserver/caddy · error

PEM leaf certificate loader, cert %d: %v

Error message

PEM leaf certificate loader, cert %d: %v

What it means

Error "PEM leaf certificate loader, cert %d: %v" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/leafpemloader.go:69

		ID:  "tls.leaf_cert_loader.pem",
		New: func() caddy.Module { return new(LeafPEMLoader) },
	}
}

// UnmarshalCaddyfile implements caddyfile.Unmarshaler.
func (fl *LeafPEMLoader) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
	d.NextArg()
	fl.Certificates = append(fl.Certificates, d.RemainingArgs()...)
	return nil
}

// LoadLeafCertificates returns the certificates contained in pl.
func (pl LeafPEMLoader) LoadLeafCertificates() ([]*x509.Certificate, error) {
	certs := make([]*x509.Certificate, 0, len(pl.Certificates))
	for i, cert := range pl.Certificates {
		derBytes, err := convertPEMToDER([]byte(cert))
		if err != nil {
			return nil, fmt.Errorf("PEM leaf certificate loader, cert %d: %v", i, err)
		}
		cert, err := x509.ParseCertificate(derBytes)
		if err != nil {
			return nil, fmt.Errorf("PEM cert %d: %v", i, err)
		}
		certs = append(certs, cert)
	}
	return certs, nil
}

// Interface guard
var (
	_ LeafCertificateLoader = (*LeafPEMLoader)(nil)
	_ caddy.Provisioner     = (*LeafPEMLoader)(nil)
)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Fix the PEM certificate at the given index; the wrapped error explains the parse failure.

When it happens

Trigger: Thrown at modules/caddytls/leafpemloader.go:69 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/0ce3721f21150062. Report an issue: GitHub.