hashicorp/nomad · error

failed to parse certificate

Error message

failed to parse certificate

What it means

After the CA pool is built, Verify parses the leaf certificate with parseCert; if that fails it wraps the failure as 'failed to parse certificate', meaning the leaf cert PEM is malformed or not a parseable x509 certificate.

Source

Thrown at helper/tlsutil/generate.go:354

		}

		return pk, nil

	default:
		return nil, fmt.Errorf("unknown PEM block type for signing key: %s", block.Type)
	}
}

func Verify(caString, certString, dns string) error {
	roots := x509.NewCertPool()
	ok := roots.AppendCertsFromPEM([]byte(caString))
	if !ok {
		return fmt.Errorf("failed to parse root certificate")
	}

	cert, err := parseCert(certString)
	if err != nil {
		return fmt.Errorf("failed to parse certificate")
	}

	opts := x509.VerifyOptions{
		DNSName: fmt.Sprint(dns),
		Roots:   roots,
	}

	_, err = cert.Verify(opts)
	return err
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Confirm the cert argument is complete PEM starting with '-----BEGIN CERTIFICATE-----'
2. Run openssl x509 -in cert.pem -noout to check the certificate parses independently
3. Re-export the certificate from the CA in standard PEM encoding

Example fix

// before
err := tlsutil.Verify(caPEM, keyPEM, "service.consul")
// after
err := tlsutil.Verify(caPEM, certPEM, "service.consul")

block, _ := pem.Decode([]byte(certString))
if block == nil || block.Type != "CERTIFICATE" {
	return errors.New("leaf cert missing or not PEM CERTIFICATE block")
}
if _, err := x509.ParseCertificate(block.Bytes); err != nil {
	return fmt.Errorf("leaf cert unparseable: %w", err)
}
err := tlsutil.Verify(caString, certString, dns)

func isParseableCertificate(pemStr string) bool {
	block, _ := pem.Decode([]byte(pemStr))
	if block == nil || block.Type != "CERTIFICATE" {
		return false
	}
	_, err := x509.ParseCertificate(block.Bytes)
	return err == nil
}

if err := tlsutil.Verify(caPEM, certPEM, dns); err != nil {
	if err.Error() == "failed to parse certificate" {
		return fmt.Errorf("leaf certificate unreadable — check cert config points at PEM cert: %w", err)
	}
	return err
}

When it happens

Trigger: Calling tlsutil.Verify(ca, cert, dns) where certString fails x509 parsing (empty string, non-PEM bytes, truncated block, or unsupported format).

Common situations: Swapped config values so the CA ended up in the cert slot with valid parse but the cert slot holds a key or garbage; template/config rendering dropped part of the cert; DER-encoded cert instead of PEM.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to parse root certificate
• no PEM-encoded data found
• failed to parse cert key pair: %w
• failed to parse cert bytes: %w
• Failed to parse any valid certificates in CA file: %s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/56b4ba9826ecab32. Report an issue: GitHub.