caddyserver/caddy · error

unrecognized certificate/key encoding format: %s

Error message

unrecognized certificate/key encoding format: %s

What it means

Error "unrecognized certificate/key encoding format: %s" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/storageloader.go:103

			return nil, err
		}

		var cert tls.Certificate
		switch pair.Format {
		case "":
			fallthrough

		case "pem":
			// if the start of the key file looks like an encrypted private key,
			// reject it with a helpful error message
			if strings.Contains(string(keyData[:40]), "ENCRYPTED") {
				return nil, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
			}

			cert, err = tls.X509KeyPair(certData, keyData)

		default:
			return nil, fmt.Errorf("unrecognized certificate/key encoding format: %s", pair.Format)
		}
		if err != nil {
			return nil, err
		}

		certs = append(certs, Certificate{Certificate: cert, Tags: pair.Tags})
	}
	return certs, nil
}

// Interface guard
var (
	_ CertificateLoader = (*StorageLoader)(nil)
	_ caddy.Provisioner = (*StorageLoader)(nil)
)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Use PEM or DER encoded certificates and keys in storage; the given encoding format is not recognized.

When it happens

Trigger: Thrown at modules/caddytls/storageloader.go:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/a3665209339ed41e. Report an issue: GitHub.