hashicorp/packer · error

parse Fulcio certificate: %w

Error message

parse Fulcio certificate: %w

What it means

This error wraps x509.ParseCertificate failing on the DER bytes returned by Fulcio's GetCertificate. The library throws it when the certificate provider returns data that is not a valid ASN.1/DER X.509 certificate — for example an error body, HTML, or a differently-encoded response from a misconfigured or incompatible Fulcio endpoint. It indicates the Fulcio response could not be interpreted as a certificate.

Source

Thrown at internal/attestation/sign_keyless.go:118

	idToken, err := resolveAmbientIDToken(ctx, cfg.Env)
	if err != nil {
		return nil, err
	}

	keypair, err := newKeylessEphemeralKeypair()
	if err != nil {
		return nil, fmt.Errorf("generate ephemeral keypair: %w", err)
	}

	fulcio := newKeylessFulcio(fulcioURL)
	certDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})
	if err != nil {
		return nil, fmt.Errorf("request Fulcio certificate: %w", err)
	}

	certificate, err := x509.ParseCertificate(certDER)
	if err != nil {
		return nil, fmt.Errorf("parse Fulcio certificate: %w", err)
	}

	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
	verifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)
	if err != nil {
		return nil, fmt.Errorf("create keyless verifier: %w", err)
	}

	return &keylessSigner{
		keypair:  keypair,
		certPEM:  certPEM,
		cert:     certificate,
		verifier: verifier,
		keyID:    hex.EncodeToString(keypair.GetHint()),
	}, nil
}

func (s *keylessSigner) Sign(ctx context.Context, payloadType string, payload []byte) (Signature, error) {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify fulcio_url points directly at a real Fulcio instance (no HTML error pages); test the endpoint manually.
2. Upgrade github.com/sigstore/sigstore-go to the latest version so response parsing matches the current Fulcio API.
3. Inspect what the endpoint actually returns (curl the cert endpoint) to identify proxy/injection issues.
4. If using a self-hosted Fulcio, confirm it is a compatible version and serving the expected API routes.

Example fix

// before
fulcio_url = "https://internal-proxy.example.com/fulcio"  // returns HTML error page
// after
fulcio_url = "https://fulcio.example.com"  // direct Fulcio instance

// Verify the Fulcio endpoint serves the expected API before signing:
resp, err := http.Get(fulcioURL + "/api/v1/rootCert")
if err != nil {
    return err
}
if ct := resp.Header.Get("Content-Type"); strings.Contains(ct, "text/html") {
    return fmt.Errorf("fulcio_url %s is not serving the Fulcio API", fulcioURL)
}

signer, err := newKeylessSigner(ctx, cfg)
if err != nil && strings.Contains(err.Error(), "parse Fulcio certificate") {
    // log the raw response from the Fulcio endpoint; fix URL or upgrade sigstore-go
}

When it happens

Trigger: newKeylessSigner (internal/attestation/sign_keyless.go:116-119) receives certDER from fulcio.GetCertificate and calls x509.ParseCertificate; error occurs when the returned bytes are not valid DER — e.g. the endpoint returned a JSON/HTML error payload the SDK passed through, or the Fulcio API version differs from what sigstore-go expects.

Common situations: A custom fulcio_url pointing at a proxy or mock that returns JSON/HTML instead of DER; an outdated sigstore-go SDK incompatible with a newer Fulcio response format; MITM/proxy injecting an error page; hitting the wrong port/path on a self-hosted Fulcio.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• summarize Fulcio certificate: %w
• load verifier %q: %w
• unsupported PEM verifier data
• marshal public key: %w
• verify Fulcio certificate chain: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c95122d331c2fb40. Report an issue: GitHub.