coollabsio/coolify · error · Exception

Invalid certificate format.

Error message

Invalid certificate format.

What it means

openssl_x509_read() on the submitted PEM returned false, meaning PHP's OpenSSL could not parse certificateContent as an X.509 certificate. Coolify uses this both to validate and to normalize (re-export) the certificate before storing it on the server, so garbage input is refused before any write. Note openssl_x509_read emits a warning and returns false rather than throwing.

Source

Thrown at app/Livewire/Server/CaCertificate/Show.php:65

        }
    }

    public function toggleCertificate()
    {
        $this->showCertificate = ! $this->showCertificate;
    }

    public function saveCaCertificate()
    {
        try {
            $this->authorize('manageCaCertificate', $this->server);
            if (! $this->certificateContent) {
                throw new \Exception('Certificate content cannot be empty.');
            }

            $parsedCert = openssl_x509_read($this->certificateContent);
            if (! $parsedCert) {
                throw new \Exception('Invalid certificate format.');
            }

            if (! openssl_x509_export($parsedCert, $cleanedCertificate)) {
                throw new \Exception('Failed to process certificate.');
            }
            $this->certificateContent = $cleanedCertificate;

            if ($this->caCertificate) {
                $this->caCertificate->ssl_certificate = $this->certificateContent;
                $this->caCertificate->save();

                $this->loadCaCertificate();

                $this->writeCertificateToServer();

                dispatch(new RegenerateSslCertJob(
                    server_id: $this->server->id,
                    force_regeneration: true

View on GitHub (pinned to 70b9acc424)

Solutions

1. Paste exactly the leaf/CA certificate PEM block: -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
2. Verify locally: openssl x509 -in cert.pem -noout -subject (errors mean the file is not a cert)
3. If you have DER, convert first: openssl x509 -inform der -in cert.der -out cert.pem
4. Ensure line breaks survived copy-paste (each base64 line ~64 chars, single trailing newline)

Example fix

// before
$this->certificateContent = "-----BEGIN PRIVATE KEY-----\nMIIEvQ...\n-----END PRIVATE KEY-----\n";

// after
$this->certificateContent = "-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgIE...\n-----END CERTIFICATE-----\n";

// pre-parse before saving
$parsed = @openssl_x509_read($certificateContent);
if ($parsed === false) {
    // reject before saveCaCertificate; check openssl_error_string() for detail
}
openssl_x509_free($parsed);

/** @param mixed $content */
function isParsableCertificate($content): bool
{
    if (! is_string($content) || $content === '') {
        return false;
    }
    $res = @openssl_x509_read($content);
    if ($res !== false) { openssl_x509_free($res); }

    return $res !== false;
}

Silence and inspect warnings with @openssl_x509_read(...) === false plus openssl_error_string(); throw/log a clear message - the function returns false rather than throwing, so a bare try/catch will not catch it.

When it happens

Trigger: Pasting a private key (-----BEGIN PRIVATE KEY-----) or a CSR instead of the certificate; missing BEGIN/END CERTIFICATE PEM headers; truncated or line-wrapped-mangled base64; DER/binary content; concatenated 'cert + chain + key' blobs where parsing of the first block fails.

Common situations: Grabbing the wrong file from the cert bundle; copy-paste losing line breaks; certificates from tools that emit PKCS#7 or DER; Windows line-ending mangles (rare - OpenSSL usually tolerates CRLF).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to process certificate.
• SSL Certificate generation failed: {$e->getMessage()}
• Certificate content cannot be empty.
• Invalid Cron / Human expression
• This server was transferred to another Coolify instance and

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/ca628893a4ce04d8. Report an issue: GitHub.