siyuan-note/siyuan · error

failed to parse CA certificate: %w

Error message

failed to parse CA certificate: %w

What it means

Returned by ImportCABundle when x509.ParseCertificate fails on the bytes decoded from the PEM block. The PEM was well-formed, but its contents are not a parseable X.509 certificate (corrupted DER, truncated, or a non-certificate PEM type that happened to decode).

Source

Thrown at kernel/util/cert.go:323

	}

	if err = pem.Encode(keyFile, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}); err != nil {
		return err
	}

	return nil
}

// ImportCABundle imports a CA certificate and private key from PEM-encoded strings.
func ImportCABundle(caCertPEM, caKeyPEM string) error {
	certBlock, _ := pem.Decode([]byte(caCertPEM))
	if certBlock == nil {
		return fmt.Errorf("failed to decode CA certificate PEM")
	}

	caCert, err := x509.ParseCertificate(certBlock.Bytes)
	if err != nil {
		return fmt.Errorf("failed to parse CA certificate: %w", err)
	}

	if !caCert.IsCA {
		return fmt.Errorf("the provided certificate is not a CA certificate")
	}

	keyBlock, _ := pem.Decode([]byte(caKeyPEM))
	if keyBlock == nil {
		return fmt.Errorf("failed to decode CA private key PEM")
	}

	_, err = x509.ParseECPrivateKey(keyBlock.Bytes)
	if err != nil {
		return fmt.Errorf("failed to parse CA private key: %w", err)
	}

	caCertPath := filepath.Join(ConfDir, TLSCACertFilename)
	caKeyPath := filepath.Join(ConfDir, TLSCAKeyFilename)

View on GitHub (pinned to 251596fc0d)

Solutions

1. Verify the file with `openssl x509 -in ca.pem -noout -text`; if it errors, obtain a correct X.509 cert.
2. If you have a PKCS#7 bundle, extract the leaf cert first (`openssl pkcs7 -in ca.p7b -print_certs -out ca.pem`).
3. Make sure the PEM block type is `CERTIFICATE`.

Example fix

// before: passing a PKCS#7 bundle whose decoded bytes are not a raw cert
ImportCABundle(pkcs7PEM, keyPEM) // -> failed to parse CA certificate

// after: extract the X.509 leaf cert from the bundle, then import
ImportCABundle(leafCertPEM, keyPEM)

if err := util.ImportCABundle(certPEM, keyPEM); err != nil {
    if strings.Contains(err.Error(), "failed to parse CA certificate") {
        // PEM decoded but DER is not X.509; likely a CSR, PKCS#7, or wrong file
        return fmt.Errorf("%v; verify with `openssl x509 -in ca.pem -noout -text`", err)
    }
    return err
}

When it happens

Trigger: Calling ImportCABundle with a PEM block whose decoded bytes are not a valid ASN.1 X.509 certificate — e.g. a PKCS#7 bundle, a CSR, or a truncated cert.

Common situations: Using the wrong PEM file (a CSR or a PKCS#7 `.p7b` instead of a leaf CA cert); a cert that was mangled in transit; a PEM whose label says CERTIFICATE but whose payload is something else.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• the provided certificate is not a CA certificate
• failed to decode CA certificate PEM
• failed to decode CA private key PEM
• failed to parse CA private key: %w
• failed to write CA certificate: %w

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/6e4d265280282dd8. Report an issue: GitHub.