grafana/k6 · error

failed to decode certificate PEM file

Error message

failed to decode certificate PEM file

What it means

Returned by parseCertificate when pem.Decode returns a nil block — a sentinel guard (no %w, nothing to unwrap) meaning the input bytes contain no valid PEM block at all (wrong type, missing BEGIN/END markers, or non-PEM content). The input at fault is the encoded certificate bytes passed to x509.parse/altNames/issuer/subject, typically from open().pem.contents or a bundled PEM string in the script.

Source

Thrown at internal/js/modules/k6/crypto/x509/x509.go:149

	if err != nil {
		return Issuer{}, err
	}
	return makeIssuer(parsed.Issuer), nil
}

// subject extracts certificate subject
func (mi X509) subject(encoded []byte) Subject {
	parsed, err := parseCertificate(encoded)
	if err != nil {
		common.Throw(mi.vu.Runtime(), err)
	}
	return makeSubject(parsed.Subject)
}

func parseCertificate(encoded []byte) (*x509.Certificate, error) {
	decoded, _ := pem.Decode(encoded)
	if decoded == nil {
		return nil, fmt.Errorf("failed to decode certificate PEM file")
	}
	parsed, err := x509.ParseCertificate(decoded.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed to parse certificate: %w", err)
	}
	return parsed, nil
}

func makeCertificate(parsed *x509.Certificate) (Certificate, error) {
	publicKey, err := makePublicKey(parsed.PublicKey)
	if err != nil {
		return Certificate{}, err
	}
	return Certificate{
		Subject:            makeSubject(parsed.Subject),
		Issuer:             makeIssuer(parsed.Issuer),
		NotBefore:          iso8601(parsed.NotBefore),
		NotAfter:           iso8601(parsed.NotAfter),

View on GitHub (pinned to 01ffac6f24)

Solutions

1. Verify the file is actually PEM-formatted with proper BEGIN/END CERTIFICATE markers
2. Check for copy-paste damage (missing headers, line-wrap corruption, CRLF issues)
3. Confirm you are reading the certificate file and not a private key or DER-encoded file
4. If the certificate is DER-encoded, convert it to PEM first (e.g. openssl x509 -inform der -out pem)

When it happens

Trigger: Thrown at internal/js/modules/k6/crypto/x509/x509.go:149 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of grafana/k6@01ffac6f24 (2026-08-18). Data as JSON: /api/errors/f331eaea31e7f3c6. Report an issue: GitHub.