{"id":"8ce7bd4b42da2193","repo":"go-sql-driver/mysql","slug":"no-pem-data-found-data-s","errorCode":null,"errorMessage":"no pem data found, data: %s","messagePattern":"no pem data found, data: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"auth.go","lineNumber":432,"sourceCode":"\t\t\t\t\t\t}\n\t\t\t\t\t\tdata[4] = cachingSha2PasswordRequestPublicKey\n\t\t\t\t\t\terr = mc.writePacket(data)\n\t\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t\treturn err\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif data, err = mc.readPacket(); err != nil {\n\t\t\t\t\t\t\treturn err\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif data[0] != iAuthMoreData {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"unexpected resp from server for caching_sha2_password, perform full authentication\")\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// parse public key\n\t\t\t\t\t\tblock, rest := pem.Decode(data[1:])\n\t\t\t\t\t\tif block == nil {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"no pem data found, data: %s\", rest)\n\t\t\t\t\t\t}\n\t\t\t\t\t\tpkix, err := x509.ParsePKIXPublicKey(block.Bytes)\n\t\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t\treturn err\n\t\t\t\t\t\t}\n\t\t\t\t\t\tpubKey = pkix.(*rsa.PublicKey)\n\t\t\t\t\t}\n\n\t\t\t\t\t// send encrypted password\n\t\t\t\t\terr = mc.sendEncryptedPassword(oldAuthData, pubKey)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn err\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn mc.resultUnchanged().readResultOK()\n\n\t\t\tdefault:\n\t\t\t\treturn ErrMalformPkt","sourceCodeStart":414,"sourceCodeEnd":450,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/c426bd93799de0f0e094c8f0582872c529d0ed0a/auth.go#L414-L450","documentation":"Thrown in the caching_sha2_password full-auth path (auth.go:432) after the server's public-key response IS received (it passed the iAuthMoreData check) but pem.Decode could not parse a PEM block from it. The %s shows the leftover bytes that pem.Decode could not consume — indicating the payload is not a valid PEM-encoded RSA public key.","triggerScenarios":"Connecting with caching_sha2_password over plain TCP without TLS, where the server DID respond to the public-key request but the payload is not PEM-encoded PKIX RSA key data — corrupted bytes, a proxy rewriting the response, or a non-conforming server.","commonSituations":"A proxy/router that mangles the auth-more-data packet; packet corruption on a flaky link; a MySQL fork that sends the key in a non-PEM format; a man-in-the-middle injecting garbage. The trailing %s in the message is the diagnostic clue.","solutions":["Enable TLS (tls=true) or use a unix socket to avoid the public-key exchange entirely.","Inspect the %s bytes in the error — if they look like an error message, the server is rejecting auth for another reason (fix the underlying auth issue).","Bypass proxies/routers; connect directly to MySQL to rule out payload mangling.","If you can pin the server key, register it as the DSN server public key to skip the exchange."],"exampleFix":"// before: caching_sha2_password over plain TCP\n// dsn := \"user:pass@tcp(host:3306)/db\"\n\n// after: TLS avoids requesting/parsing the server public key\ndsn := \"user:pass@tcp(host:3306)/db?tls=skip-verify\"\ndb, err := sql.Open(\"mysql\", dsn)","handlingStrategy":"validation","validationCode":"// prefer TLS/unix so the server key is never requested/parsed\nfunc safeDSN(user, pass, host, db string) string {\n    return fmt.Sprintf(\"%s:%s@tcp(%s)/%s?tls=true\", user, pass, host, db)\n}","typeGuard":null,"tryCatchPattern":"if err := db.PingContext(ctx); err != nil {\n    if strings.Contains(err.Error(), \"no pem data found\") {\n        // server's key payload was unparseable; switch to TLS/unix and retry\n    }\n}","preventionTips":["Use TLS or a unix socket with caching_sha2_password to skip public-key exchange.","Keep proxies/routers out of the auth path; they commonly mangle auth-more-data packets.","Pin the server public key in the DSN when TLS is unavailable."],"tags":["auth","caching-sha2","pem","tls","wire-format"],"analyzedSha":"c426bd93799de0f0e094c8f0582872c529d0ed0a","analyzedAt":"2026-08-04T21:52:59.219Z","schemaVersion":2}