What causes "Unsupported PEM type '${match[1]}'" in gchq/CyberChef?

Remove or isolate non-key / non-certificate PEM blocks from the input.

gchq/CyberChef · error · OperationError

Unsupported PEM type '${match[1]}'

Error message

Unsupported PEM type '${match[1]}'

What it means

PEMToJWK handles only two block categories: labels containing 'KEY' (parsed as a key) and the exact label 'CERTIFICATE'. Any other matched label falls through to this else branch. The BEGIN regex requires uppercase letters and spaces, so it can match labels like 'X509 CRL' or 'EC PARAMETERS' that this operation cannot convert.

Source

Thrown at src/core/operations/PEMToJWK.mjs:81

                if (key.type === "DSA") {
                    throw new OperationError("DSA keys are not supported for JWK");
                }
                const jwk = r.KEYUTIL.getJWKFromKey(key);
                if (output.length > 0) {
                    output += "\n";
                }
                output += JSON.stringify(jwk);
            } else if (match[1] === "CERTIFICATE") {
                const cert = new r.X509();
                cert.readCertPEM(pem);
                const key = cert.getPublicKey();
                const jwk = r.KEYUTIL.getJWKFromKey(key);
                if (output.length > 0) {
                    output += "\n";
                }
                output += JSON.stringify(jwk);
            } else {
                throw new OperationError(`Unsupported PEM type '${match[1]}'`);
            }
        }
        return output;
    }
}

export default PEMToJWK;

View on GitHub (pinned to 4290ea7539)

Solutions

Remove or isolate non-key / non-certificate PEM blocks from the input.
For certificates use the exact label 'CERTIFICATE'; for keys ensure the label contains 'KEY'.
Pre-filter input to keep only BEGIN ... KEY and BEGIN CERTIFICATE blocks.

Example fix

// before: bundle includes an unhandled block type
-----BEGIN X509 CRL-----
...
// after: pass only key/certificate blocks
-----BEGIN CERTIFICATE-----
...

Defensive patterns

Strategy: validation

Validate before calling

function classifyPemBlocks(pem) {
    const re = /-----BEGIN ([A-Z][A-Z ]+[A-Z])-----/g;
    const supported = [], unsupported = [];
    let m;
    while ((m = re.exec(pem)) !== null) {
        (m[1].includes('KEY') || m[1] === 'CERTIFICATE' ? supported : unsupported).push(m[1]);
    }
    return { supported, unsupported };
}

Prevention

Feed only KEY- or CERTIFICATE-labelled PEM blocks to PEMToJWK.
Strip CRL, parameters, and other block types before conversion.
Pre-scan input to reject unsupported labels.

When it happens

Trigger: Input contains a PEM block whose label is neither a *KEY nor 'CERTIFICATE' - e.g. '-----BEGIN X509 CRL-----', '-----BEGIN EC PARAMETERS-----', or '-----BEGIN TRUSTED CERTIFICATE-----'.

Common situations: Pasting a CRL, parameters block, or non-key/cert PEM alongside real keys; mixed bundles where an unhandled block type appears; concatenated files (key + CRL).

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/351e01b470ddbb54. Report an issue: GitHub.