cloudflare/cloudflared · error

pem encoding failed: %v

Error message

pem encoding failed: %v

What it means

After building the PEM block, EncodeOriginCert writes it via pem.Encode into a bytes.Buffer; any encoder failure is wrapped as "pem encoding failed: %v". This is the final serialization step ensuring the returned bytes are a properly encoded PEM representation of the origin certificate token.

Source

Thrown at credentials/origin_cert.go:78

}

func (cert *OriginCert) EncodeOriginCert() ([]byte, error) {
	if cert == nil {
		return nil, fmt.Errorf("originCert cannot be nil")
	}
	buffer, err := json.Marshal(cert)
	if err != nil {
		return nil, fmt.Errorf("originCert marshal failed: %v", err)
	}
	block := pem.Block{
		Type:    "ARGO TUNNEL TOKEN",
		Headers: map[string]string{},
		Bytes:   buffer,
	}
	var out bytes.Buffer
	err = pem.Encode(&out, &block)
	if err != nil {
		return nil, fmt.Errorf("pem encoding failed: %v", err)
	}
	return out.Bytes(), nil
}

func decodeOriginCert(blocks []byte) (*OriginCert, error) {
	if len(blocks) == 0 {
		return nil, fmt.Errorf("cannot decode empty certificate")
	}
	originCert := OriginCert{}
	block, rest := pem.Decode(blocks)
	for block != nil {
		switch block.Type {
		case "PRIVATE KEY", "CERTIFICATE":
			// this is for legacy purposes.
		case "ARGO TUNNEL TOKEN":
			if originCert.ZoneID != "" || originCert.APIToken != "" {
				return nil, fmt.Errorf("found multiple tokens in the certificate")
			}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Retry the encode operation — bytes.Buffer failures are typically transient (e.g. OOM)
2. Check available memory if failures repeat during certificate encoding
3. Inspect the wrapped error for the underlying writer failure cause
4. Upgrade Go runtime if the failure traces to a known stdlib pem/writer bug

Example fix

null

out, err := cert.EncodeOriginCert()
if err != nil {
	if strings.Contains(err.Error(), "pem encoding failed") {
		out, err = cert.EncodeOriginCert() // single retry; usually transient
	}
}
return out, err

When it happens

Trigger: pem.Encode returns a non-nil error while writing the block to the buffer — extremely rare with a bytes.Buffer, but possible if the writer errors; reached whenever EncodeOriginCert is called and marshaling succeeded.

Common situations: Essentially only seen in exotic failure conditions or in tests that inject failing writers; if you see it in production, memory/allocation failures during buffer writes are the likely cause.

Understand the failure class

Background: "JSON serialization failed", "not JSON serializable", "Failed to serialize": why JSON marshaling errors happen and how to fix them — this error's family across 46 libraries.

Related errors

• originCert cannot be nil
• error parsing OriginCert: %v
• originCert marshal failed: %v
• cannot decode empty certificate
• found multiple tokens in the certificate

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/186b4be305bc2cd8. Report an issue: GitHub.