What causes "PEM truststore contains no certificates" in t8y2/dbx?

Verify the file contains BEGIN CERTIFICATE blocks: grep -c 'BEGIN CERTIFICATE' truststore.pem (must be > 0).

PEM truststore contains no certificates

Error message

PEM truststore contains no certificates

What it means

parsePEMCertificates scans PEM blocks from a truststore file and found no parseable CERTIFICATE blocks, so loadTrustStore cannot build a CA pool. The library refuses to continue with an empty trust store.

Source

Thrown at agents/drivers/hive-go/zookeeper_tls.go:224

func parsePEMCertificates(contents []byte) ([]*x509.Certificate, error) {
	var certificates []*x509.Certificate
	for len(contents) > 0 {
		block, rest := pem.Decode(contents)
		if block == nil {
			break
		}
		contents = rest
		if block.Type != "CERTIFICATE" {
			continue
		}
		certificate, err := x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, err
		}
		certificates = append(certificates, certificate)
	}
	if len(certificates) == 0 {
		return nil, errors.New("PEM truststore contains no certificates")
	}
	return certificates, nil
}

func parsePrivateKey(contents []byte) (any, error) {
	if value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {
		return value, nil
	}
	if value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {
		return value, nil
	}
	if value, err := x509.ParseECPrivateKey(contents); err == nil {
		return value, nil
	}
	return nil, errors.New("unsupported private key encoding")
}

View on GitHub (pinned to c0390bff16)

Solutions

Verify the file contains BEGIN CERTIFICATE blocks: grep -c 'BEGIN CERTIFICATE' truststore.pem (must be > 0).
Convert DER certs to PEM: openssl x509 -inform DER -in ca.crt -out ca.pem, then reference the PEM file.
Fix the path configuration so the truststore points to the actual CA bundle file.

Example fix

# before
truststorePath=/etc/ssl/certs/ca.der
# after
openssl x509 -inform DER -in /etc/ssl/certs/ca.der -out /etc/ssl/certs/ca.pem
truststorePath=/etc/ssl/certs/ca.pem

Defensive patterns

Strategy: validation

Validate before calling

func pemTruststoreHasCerts(path string) error {
	b, err := os.ReadFile(path); if err != nil { return err }
	if !bytes.Contains(b, []byte("-----BEGIN CERTIFICATE-----")) {
		return errors.New("no PEM certificates in " + path)
	}
	return nil
}

Type guard

func isPEMCertificateBlock(block *pem.Block) bool { return block != nil && block.Type == "CERTIFICATE" }

Try / catch

pool, err := loadTrustStore(path)
if err != nil {
	if strings.Contains(err.Error(), "no certificates") {
		return fmt.Errorf("truststore %s has no PEM certs; convert DER with 'openssl x509 -inform DER'", path)
	}
	return err
}

Prevention

Always distribute CA bundles in PEM format for this driver.
Sanity-check with 'grep -c BEGIN CERTIFICATE file' before referencing a truststore path.
Avoid pointing truststore config at keystores or key files by mistake — validate file contents at startup.

When it happens

Trigger: The file referenced as a PEM truststore is empty, contains only a private key or non-certificate PEM blocks (e.g. only PUBLIC KEY), or the certs are in DER (binary) rather than PEM format.

Common situations: Pointing the truststore at a DER-encoded .crt; wrong file path resolving to an empty/placeholder file; a file containing concatenated keys but no certificates.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/3a3d911eeeb3a963. Report an issue: GitHub.