What causes "PEM truststore contains no certificates" in t8y2/dbx?

Verify the file contains '-----BEGIN CERTIFICATE-----' blocks: grep -c 'BEGIN CERTIFICATE' truststore.pem

PEM truststore contains no certificates

Error message

PEM truststore contains no certificates

What it means

parsePEMCertificates decodes a PEM truststore into x509 certificates. If the PEM data yields zero certificates, it returns this error because an empty truststore cannot be used for TLS server verification. Invoked by loadTrustStore when the store type is PEM.

Source

Thrown at agents/drivers/argo-go/zookeeper_tls.go:224

func parsePEMCertificates(contents []byte) ([]*x509.Certificate, error) {
	var certificates []*x509.Certificate
	for len(contents) > 0 {
		block, rest := pem.Decode(contents)
		if block == nil {
			break
		}
		contents = rest
		if block.Type != "CERTIFICATE" {
			continue
		}
		certificate, err := x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, err
		}
		certificates = append(certificates, certificate)
	}
	if len(certificates) == 0 {
		return nil, errors.New("PEM truststore contains no certificates")
	}
	return certificates, nil
}

func parsePrivateKey(contents []byte) (any, error) {
	if value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {
		return value, nil
	}
	if value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {
		return value, nil
	}
	if value, err := x509.ParseECPrivateKey(contents); err == nil {
		return value, nil
	}
	return nil, errors.New("unsupported private key encoding")
}

View on GitHub (pinned to c0390bff16)

Solutions

Verify the file contains '-----BEGIN CERTIFICATE-----' blocks: grep -c 'BEGIN CERTIFICATE' truststore.pem
Convert DER certs to PEM if needed: openssl x509 -inform der -in ca.crt -out ca.pem
Check the mounted secret/env var actually contains the CA certificate text, not an empty value
Ensure you pass the CA/public cert, not the private key PEM

Example fix

// before: truststore.pem contains '-----BEGIN PRIVATE KEY-----' only
// after: export CA to PEM
# openssl x509 -inform der -in ca.der -out truststore.pem

Defensive patterns

Strategy: validation

Validate before calling

pemBytes, err := os.ReadFile(truststorePath)
if err != nil { return err }
if !bytes.Contains(pemBytes, []byte("-----BEGIN CERTIFICATE-----")) {
    return fmt.Errorf("%s contains no PEM certificates", truststorePath)
}

Try / catch

certs, err := parsePEMCertificates(data)
if err != nil && strings.Contains(err.Error(), "PEM truststore contains no certificates") {
    // surface: check secret mount / file contents
}

Prevention

Check file size and 'BEGIN CERTIFICATE' presence at startup, not only on first TLS handshake
Ensure Kubernetes secrets mount the CA cert key, not an empty template value
Convert DER certs to PEM before bundling

When it happens

Trigger: buildTLSConfig/buildZooKeeperTLSConfig given a truststorePath whose file contains no CERTIFICATE PEM blocks — an empty file, a file with only PRIVATE KEY blocks, or binary/DER content mislabeled as .pem.

Common situations: Config var pointing to a path that exists but is empty (e.g. a mounted Kubernetes secret key not set); pasting a private key instead of the CA cert; downloading a cert that came as DER; concatenated bundle lost during secret templating.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2057b52a6f8b3c8e. Report an issue: GitHub.