cloudflare/cloudflared · error

error parsing OriginCert: %v

Error message

error parsing OriginCert: %v

What it means

OriginCert.UnmarshalJSON decodes the JSON representation of an origin certificate (zoneID, accountID, apiToken, endpoint). If the bytes are not valid JSON or don't match the expected object shape, the raw json.Unmarshal error is wrapped as "error parsing OriginCert: %v". This lets callers detect corrupted or wrongly-formatted origin cert data early.

Source

Thrown at credentials/origin_cert.go:37

	DefaultCredentialFile = "cert.pem"
)

type OriginCert struct {
	ZoneID    string `json:"zoneID"`
	AccountID string `json:"accountID"`
	APIToken  string `json:"apiToken"`
	Endpoint  string `json:"endpoint,omitempty"`
}

func (oc *OriginCert) UnmarshalJSON(data []byte) error {
	var aux struct {
		ZoneID    string `json:"zoneID"`
		AccountID string `json:"accountID"`
		APIToken  string `json:"apiToken"`
		Endpoint  string `json:"endpoint,omitempty"`
	}
	if err := json.Unmarshal(data, &aux); err != nil {
		return fmt.Errorf("error parsing OriginCert: %v", err)
	}
	oc.ZoneID = aux.ZoneID
	oc.AccountID = aux.AccountID
	oc.APIToken = aux.APIToken
	oc.Endpoint = strings.ToLower(aux.Endpoint)
	return nil
}

// FindDefaultOriginCertPath returns the first path that contains a cert.pem file. If none of the
// DefaultConfigSearchDirectories contains a cert.pem file, return empty string
func FindDefaultOriginCertPath() string {
	for _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {
		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, DefaultCredentialFile))
		if ok := fileExists(originCertPath); ok {
			return originCertPath
		}
	}
	return ""

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Verify the origin cert file contains valid JSON: run it through `jq .` or `python -m json.tool`
2. Confirm the field types match the schema (strings for zoneID, accountID, apiToken)
3. Re-download or re-issue the origin certificate from Cloudflare
4. Check that the PEM block decoded contains ARGO TUNNEL TOKEN bytes, not some other block

Example fix

// before
certData := readFile("cert.txt") // contains garbage/truncated JSON
// after
certData, err := os.ReadFile("cert.pem")
if err != nil { return err }
if !json.Valid(certData) { return errors.New("origin cert file is not valid JSON") }

data, err := os.ReadFile(certPath)
if err != nil { return err }
if !json.Valid(data) {
	return fmt.Errorf("origin cert file %s is not valid JSON", certPath)
}

cert, err := DecodeOriginCert(blocks)
if err != nil {
	if strings.Contains(err.Error(), "error parsing OriginCert") {
		return fmt.Errorf("origin cert file is corrupted or wrong format: %w", err)
	}
	return err
}

When it happens

Trigger: Calling json.Unmarshal/Decode on a []byte or stream that is not a JSON object matching the OriginCert fields — e.g. a PEM block's bytes that contain non-JSON payload, truncated cert files, or JSON with wrong field types (e.g. zoneID as a number).

Common situations: Cert files edited by hand breaking JSON syntax; credentials fetched from an endpoint returning HTML/HTML error pages instead of JSON; wrong file passed to the origin-cert flag.

Understand the failure class

Background: "failed to unmarshal" / json.Unmarshal errors: why parsing a response into a Go struct fails and how to fix it — this error's family across 23 libraries.

Related errors

• originCert marshal failed: %v
• originCert cannot be nil
• pem encoding failed: %v
• unknown block %s in the certificate
• error parsing files current field '%s': %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/42fab06ee3b27163. Report an issue: GitHub.