{"id":"b8a4fdcd4abf5367","repo":"go-sql-driver/mysql","slug":"no-pem-data-found-data-s-b8a4fd","errorCode":null,"errorMessage":"no Pem data found, data: %s","messagePattern":"no Pem data found, data: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"auth.go","lineNumber":463,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn mc.resultUnchanged().readResultOK()\n\n\t\t\tdefault:\n\t\t\t\treturn ErrMalformPkt\n\t\t\t}\n\t\tdefault:\n\t\t\treturn ErrMalformPkt\n\t\t}\n\n\tcase \"sha256_password\":\n\t\tswitch len(authData) {\n\t\tcase 0:\n\t\t\treturn nil // auth successful\n\t\tdefault:\n\t\t\tblock, _ := pem.Decode(authData)\n\t\t\tif block == nil {\n\t\t\t\treturn fmt.Errorf(\"no Pem data found, data: %s\", authData)\n\t\t\t}\n\n\t\t\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\t// send encrypted password\n\t\t\terr = mc.sendEncryptedPassword(oldAuthData, pub.(*rsa.PublicKey))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\treturn mc.resultUnchanged().readResultOK()\n\t\t}\n\n\tdefault:\n\t\treturn nil // auth successful\n\t}","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/c426bd93799de0f0e094c8f0582872c529d0ed0a/auth.go#L445-L481","documentation":"Thrown in the sha256_password auth path (auth.go:463) when pem.Decode on the server's authData returns no PEM block. Unlike caching_sha2_password, here the server is expected to send its RSA public key directly in the auth response; if those bytes aren't a valid PEM key, parsing fails. Note the capital 'P' — distinct string from error 54.","triggerScenarios":"Connecting to a server using the legacy sha256_password plugin over a non-TLS connection (the plugin requires RSA key exchange when TLS is absent), where the server's key payload is not parseable PEM — corrupted bytes, proxy mangling, or a non-conforming server.","commonSituations":"An older MySQL/MariaDB configured with sha256_password and no TLS; a proxy rewriting the auth payload; packet corruption; server configured to not advertise its key. The %s shows the offending bytes.","solutions":["Enable TLS in the DSN so sha256_password uses cleartext over the encrypted channel and skips the key exchange.","Inspect the %s bytes: if they resemble an error string, resolve the root auth failure first.","Connect directly to MySQL, bypassing any proxy/router that may mangle the auth packet.","Ensure the server is configured to provide its RSA public key (sha256_password_public_key_path / caching_sha2... server vars) if you must run without TLS."],"exampleFix":"// before: sha256_password over plain TCP\n// dsn := \"user:pass@tcp(host:3306)/db\"\n\n// after: TLS removes the need for the key exchange\ndsn := \"user:pass@tcp(host:3306)/db?tls=skip-verify\"\ndb, err := sql.Open(\"mysql\", dsn)","handlingStrategy":"validation","validationCode":"// for sha256_password, TLS removes the need to receive/parse the server key\nfunc sha256SafeDSN(user, pass, host, db string) string {\n    return fmt.Sprintf(\"%s:%s@tcp(%s)/%s?tls=true\", user, pass, host, db)\n}","typeGuard":null,"tryCatchPattern":"if err := db.PingContext(ctx); err != nil {\n    if strings.Contains(err.Error(), \"no Pem data found\") {\n        // enable TLS or unix socket and retry\n    }\n}","preventionTips":["Run sha256_password connections over TLS or a unix socket.","Ensure the server is configured to publish its RSA public key if TLS is off.","Avoid proxies that rewrite the sha256_password auth payload."],"tags":["auth","sha256","pem","tls","wire-format"],"analyzedSha":"c426bd93799de0f0e094c8f0582872c529d0ed0a","analyzedAt":"2026-08-04T21:52:59.219Z","schemaVersion":2}