hyperledger/fabric · error

%s: wrong PEM encoding

Error message

%s: wrong PEM encoding

What it means

newCertKeyPair generates a key/cert and PEM-encodes it, then immediately decodes the CERTIFICATE PEM block to parse it. A nil block means the PEM-encoding produced bytes that pem.Decode cannot parse — per the comment, this should never happen unless x509/pem are buggy. The error message embeds the offending PEM bytes.

Source

Thrown at common/crypto/tlsgen/key.go:104

	}
	template.SubjectKeyId, err = computeSKI(&privateKey.PublicKey)
	if err != nil {
		return nil, err
	}
	// If no parent cert, it's a self signed cert
	if parent == nil || certSigner == nil {
		parent = &template
		certSigner = privateKey
	}
	rawBytes, err := x509.CreateCertificate(rand.Reader, &template, parent, &privateKey.PublicKey, certSigner)
	if err != nil {
		return nil, err
	}
	pubKey := encodePEM("CERTIFICATE", rawBytes)

	block, _ := pem.Decode(pubKey)
	if block == nil { // Never comes unless x509 or pem has bug
		return nil, errors.Errorf("%s: wrong PEM encoding", pubKey)
	}
	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return nil, err
	}
	privKey := encodePEM("EC PRIVATE KEY", privBytes)
	return &CertKeyPair{
		Key:     privKey,
		Cert:    pubKey,
		Signer:  privateKey,
		TLSCert: cert,
	}, nil
}

func encodePEM(keyType string, data []byte) []byte {
	return pem.EncodeToMemory(&pem.Block{Type: keyType, Bytes: data})
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Retry the CA/cert generation call — this is an unexpected internal failure
2. Verify the Go runtime version and update to a supported release
3. Report a bug with Go/ fabric versions if reproducible

kp, err := tlsgen.NewCA()
if err != nil && strings.Contains(err.Error(), "wrong PEM encoding") {
    return retryCA() // transient crypto-stack failure; retry
}

When it happens

Trigger: Calling NewCA, NewIntermediateCA, NewClientCertKeyPair, or NewServerCertKeyPair when pem.Decode of the freshly generated CERTIFICATE PEM returns nil (crypto/tls or encoding/pem internal failure).

Common situations: Practically only hit with corrupted Go crypto stacks or extreme resource failures during cert generation; effectively an internal invariant violation.

Related errors

• failed to add ca-file PEM to cert pool
• no PEM data found in cert[% x]
• enrollment certificate isn't a valid PEM block
• enrollment certificate should be a certificate, got a %s ins
• loading client cert/key pair: %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/4c918917052fde07. Report an issue: GitHub.