hashicorp/packer · error

unsupported PEM verifier data

Error message

unsupported PEM verifier data

What it means

loadPEMPublicKey found a valid PEM block but its DER payload is none of the supported verifier inputs: it is not a PKIX public key, not an X.509 certificate, and not a parseable private key. The library has exhausted its supported formats and rejects the data outright.

Source

Thrown at internal/attestation/sign_key.go:189

}

func loadPEMPublicKey(contents []byte) (crypto.PublicKey, []byte, error) {
	block, _ := pem.Decode(contents)
	if block == nil {
		return nil, nil, fmt.Errorf("no PEM block found")
	}

	if publicKey, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {
		return publicKey, pem.EncodeToMemory(block), nil
	}
	if certificate, err := x509.ParseCertificate(block.Bytes); err == nil {
		return certificate.PublicKey, pem.EncodeToMemory(block), nil
	}
	if privateKey, verifier, err := loadPEMPrivateKeyAsPublic(contents); err == nil {
		return privateKey, verifier, nil
	}

	return nil, nil, fmt.Errorf("unsupported PEM verifier data")
}

func loadPEMPrivateKeyAsPublic(contents []byte) (crypto.PublicKey, []byte, error) {
	block, _ := pem.Decode(contents)
	if block == nil {
		return nil, nil, fmt.Errorf("no PEM block found")
	}

	var signer crypto.Signer
	if key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {
		var ok bool
		signer, ok = key.(crypto.Signer)
		if !ok {
			return nil, nil, fmt.Errorf("private key does not implement crypto.Signer")
		}
	} else if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
		signer = key
	} else if key, err := x509.ParseECPrivateKey(block.Bytes); err == nil {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Export the intended public key explicitly: 'openssl pkey -in key.pem -pubout -out verifier.pem' (yields BEGIN PUBLIC KEY).
2. If you intend certificate-based verification, provide the full X.509 certificate PEM ('BEGIN CERTIFICATE'), not a CSR or CRL.
3. Decrypt encrypted private keys before use: 'openssl pkcs8 -in enc.pem -out plain.pem'.
4. Sanity-check the payload with 'openssl asn1parse -in file.pem' to see what the DER actually contains.

Example fix

// before
v, err := attestation.LoadPEMVerifier("request.csr") // unsupported PEM verifier data
// after
$ openssl req -in request.csr -pubkey -noout > verifier.pem
v, err := attestation.LoadPEMVerifier("verifier.pem")

raw, _ := os.ReadFile(path)
block, _ := pem.Decode(raw)
if block == nil {
	return fmt.Errorf("%s: no PEM block", path)
}
if _, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {
	return nil // PKIX public key: accepted
}
if _, err := x509.ParseCertificate(block.Bytes); err == nil {
	return nil // certificate: accepted
}
return fmt.Errorf("%s: PEM payload is not a PKIX public key or X.509 certificate", path)

v, err := attestation.LoadPEMVerifier(path)
if err != nil && strings.Contains(err.Error(), "unsupported PEM verifier data") {
	return fmt.Errorf("%s must contain a PUBLIC KEY or CERTIFICATE; export with: openssl pkey -in key.pem -pubout -out verifier.pem", path)
}

When it happens

Trigger: Calling LoadPEMVerifier/LoadPEMVerifierBytes with PEM blocks like '-----BEGIN CSR-----' (certificate request), '-----BEGIN X509 CRL-----', '-----BEGIN PKCS7-----', an encrypted 'ENCRYPTED PRIVATE KEY', or a corrupted DER body.

Common situations: Configuring a CSR where a public key was expected; passing a PKCS#7 chain file; using an encrypted private key without stripping the passphrase; passing a legacy key format (PVK, PFX extracted block) that Go's x509 parsers reject.

Related errors

• load verifier %q: %w
• unsupported private key in signer %q
• unsupported private key data
• marshal public key: %w
• decode keyless certificate: no PEM block found

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/dba5b92b288912c7. Report an issue: GitHub.