{"id":"caeced0bad507e38","repo":"docker/cli","slug":"file-contents-must-be-in-pem-format","errorCode":null,"errorMessage":"file contents must be in PEM format","messagePattern":"file contents must be in PEM format","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/opts.go","lineNumber":148,"sourceCode":"\n// Type returns the type of this option.\nfunc (*PEMFile) Type() string {\n\treturn \"pem-file\"\n}\n\n// String returns the path to the pem file\nfunc (p *PEMFile) String() string {\n\treturn p.path\n}\n\n// Set parses a root rotation option\nfunc (p *PEMFile) Set(value string) error {\n\tcontents, err := os.ReadFile(value)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif pemBlock, _ := pem.Decode(contents); pemBlock == nil {\n\t\treturn errors.New(\"file contents must be in PEM format\")\n\t}\n\tp.contents, p.path = string(contents), value\n\treturn nil\n}\n\n// Contents returns the contents of the PEM file\nfunc (p *PEMFile) Contents() string {\n\treturn p.contents\n}\n\n// parseExternalCA parses an external CA specification from the command line,\n// such as protocol=cfssl,url=https://example.com.\nfunc parseExternalCA(caSpec string) (*swarm.ExternalCA, error) {\n\tcsvReader := csv.NewReader(strings.NewReader(caSpec))\n\tfields, err := csvReader.Read()\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/swarm/opts.go#L130-L166","documentation":"Raised by the PEMFile flag type's Set method when the file passed to a certificate/key flag (e.g. `--ca-cert` or `--ca-key` on `docker swarm ca`) reads successfully but pem.Decode finds no PEM block in it. The CLI validates client-side that the file contains at least one `-----BEGIN ...-----` block before sending it to the daemon.","triggerScenarios":"Passing a file to a pem-file flag whose contents are not PEM: a DER-encoded certificate, a PKCS#12 (.pfx/.p12) bundle, an empty file, a file with Windows BOM/encoding corruption, or accidentally passing the wrong path (e.g. a config file).","commonSituations":"Exporting certificates from Windows tooling in DER/PKCS#12 format instead of PEM; copy-pasting a cert and losing the BEGIN/END header lines; pointing the flag at the key when both cert and key live in differently formatted files.","solutions":["Inspect the file — it must start with a `-----BEGIN CERTIFICATE-----` (or similar) header.","Convert DER to PEM: `openssl x509 -inform der -in cert.der -out cert.pem`.","Extract from PKCS#12: `openssl pkcs12 -in bundle.p12 -out cert.pem -nokeys`.","Check for an empty file or wrong path passed to the flag."],"exampleFix":"# before\ndocker swarm ca --rotate --ca-cert cert.der --ca-key key.pem\n# after\nopenssl x509 -inform der -in cert.der -out cert.pem\ndocker swarm ca --rotate --ca-cert cert.pem --ca-key key.pem","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker","swarm","pem","certificate","cli-flags"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}