kubernetes/kops · error

could not parse certificate

Error message

could not parse certificate

What it means

A sentinel error raised by parsePEMCertificate when pem.Decode finds no PEM block at all in the input bytes — the data contains no recognizable BEGIN/END PEM structure, so no certificate can be extracted.

Source

Thrown at pkg/pki/certificate.go:100

		return nil, err
	}

	c := &Certificate{
		Subject:     cert.Subject,
		Certificate: cert,
		PublicKey:   cert.PublicKey,
		IsCA:        cert.IsCA,
	}
	return c, nil
}

var _ io.WriterTo = &Certificate{}

func parsePEMCertificate(pemData []byte) (*x509.Certificate, error) {
	for {
		block, rest := pem.Decode(pemData)
		if block == nil {
			return nil, fmt.Errorf("could not parse certificate")
		}

		if block.Type == "CERTIFICATE" {
			klog.V(10).Infof("Parsing pem block: %q", block.Type)
			return x509.ParseCertificate(block.Bytes)
		}
		klog.Infof("Ignoring unexpected PEM block: %q", block.Type)

		pemData = rest
	}
}

func (c *Certificate) AsString() (string, error) {
	// Nicer behaviour because this is called from templates
	if c == nil {
		return "", fmt.Errorf("AsString called on nil Certificate")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the input is PEM-encoded (-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----)
2. Check for truncation, whitespace stripping, or encoding corruption of the stored certificate
3. If the data is base64, decode it first (UnmarshalJSON already attempts this fallback)

When it happens

Trigger: Thrown at pkg/pki/certificate.go:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f6a6851544102f4a. Report an issue: GitHub.