grafana/k6 · error

failed to parse certificate: %w

Error message

failed to parse certificate: %w

What it means

Returned by parseCertificate when the PEM block decoded successfully but x509.ParseCertificate rejects its DER payload ('%w' carries the x509 error detail). This means the input is well-formed PEM yet not a valid X.509 certificate — e.g. a PEM-wrapped private key, CSR, or a truncated/corrupted certificate body.

Source

Thrown at internal/js/modules/k6/crypto/x509/x509.go:153

}

// subject extracts certificate subject
func (mi X509) subject(encoded []byte) Subject {
	parsed, err := parseCertificate(encoded)
	if err != nil {
		common.Throw(mi.vu.Runtime(), err)
	}
	return makeSubject(parsed.Subject)
}

func parseCertificate(encoded []byte) (*x509.Certificate, error) {
	decoded, _ := pem.Decode(encoded)
	if decoded == nil {
		return nil, fmt.Errorf("failed to decode certificate PEM file")
	}
	parsed, err := x509.ParseCertificate(decoded.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed to parse certificate: %w", err)
	}
	return parsed, nil
}

func makeCertificate(parsed *x509.Certificate) (Certificate, error) {
	publicKey, err := makePublicKey(parsed.PublicKey)
	if err != nil {
		return Certificate{}, err
	}
	return Certificate{
		Subject:            makeSubject(parsed.Subject),
		Issuer:             makeIssuer(parsed.Issuer),
		NotBefore:          iso8601(parsed.NotBefore),
		NotAfter:           iso8601(parsed.NotAfter),
		AltNames:           altNames(parsed),
		SignatureAlgorithm: signatureAlgorithm(parsed.SignatureAlgorithm),
		FingerPrint:        fingerPrint(parsed),
		PublicKey:          publicKey,

View on GitHub (pinned to 01ffac6f24)

Solutions

1. Ensure the PEM content is a certificate, not a key or CSR (check the BEGIN line says CERTIFICATE)
2. Re-export the certificate from a trusted source to rule out corruption
3. Read the wrapped x509 error (e.g. 'malformed certificate') for the precise parse failure
4. Validate the file with openssl x509 -in file.pem -noout to confirm it parses outside k6

When it happens

Trigger: Thrown at internal/js/modules/k6/crypto/x509/x509.go:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of grafana/k6@01ffac6f24 (2026-08-18). Data as JSON: /api/errors/f237ee92b3cc8f53. Report an issue: GitHub.