goharbor/harbor · error

invalid CA certificate: %w

Error message

invalid CA certificate: %w

What it means

Error "invalid CA certificate: %w" thrown in goharbor/harbor.

Source

Thrown at src/common/http/transport.go:121

func normalizePEM(cert string) string {
	cert = strings.TrimSpace(cert)
	cert = strings.ReplaceAll(cert, "\r\n", "\n")
	cert = strings.ReplaceAll(cert, "\r", "\n")
	return cert
}

// ValidateCACertificate validates whether the provided CA certificate string
// contains at least one valid PEM-encoded x509 certificate.
func ValidateCACertificate(caCert string) error {
	caCert = normalizePEM(caCert)
	if caCert == "" {
		return nil
	}

	// Attempt to parse one or more certificates from the provided PEM
	certs, err := parseCertificatesFromPEM(caCert)
	if err != nil {
		return fmt.Errorf("invalid CA certificate: %w", err)
	}

	if len(certs) == 0 {
		return errors.New("invalid CA certificate: no valid certificates found in PEM data")
	}

	return nil
}

// parseCertificatesFromPEM decodes all PEM blocks and parses certificates.
func parseCertificatesFromPEM(pemData string) ([]*x509.Certificate, error) {
	var certs []*x509.Certificate
	rest := []byte(pemData)

	for {
		var block *pem.Block
		block, rest = pem.Decode(rest)
		if block == nil {

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/common/http/transport.go:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/7af938e2958839b4. Report an issue: GitHub.