{"id":"34560b93dc415987","repo":"gohugoio/hugo","slug":"failed-to-parse-certificate-v","errorCode":null,"errorMessage":"failed to parse certificate: %v","messagePattern":"failed to parse certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"commands/server.go","lineNumber":738,"sourceCode":"\t// Yes, this is unfortunate, but it's currently the only way to use Mkcert as a library.\n\tos.Args = []string{\"-cert-file\", c.tlsCertFile, \"-key-file\", c.tlsKeyFile, hostname}\n\treturn mclib.RunMain()\n}\n\nfunc (c *serverCommand) verifyCert(rootPEM, certPEM []byte, name string) error {\n\troots := x509.NewCertPool()\n\tok := roots.AppendCertsFromPEM(rootPEM)\n\tif !ok {\n\t\treturn fmt.Errorf(\"failed to parse root certificate\")\n\t}\n\n\tblock, _ := pem.Decode(certPEM)\n\tif block == nil {\n\t\treturn fmt.Errorf(\"failed to parse certificate PEM\")\n\t}\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse certificate: %v\", err.Error())\n\t}\n\n\topts := x509.VerifyOptions{\n\t\tDNSName: name,\n\t\tRoots:   roots,\n\t}\n\n\tif _, err := cert.Verify(opts); err != nil {\n\t\treturn fmt.Errorf(\"failed to verify certificate: %v\", err.Error())\n\t}\n\n\treturn nil\n}\n\nfunc (c *serverCommand) createServerPorts(cd *simplecobra.Commandeer) error {\n\tflags := cd.CobraCommand.Flags()\n\tvar cerr error\n\tc.withConf(func(conf *commonConfig) {","sourceCodeStart":720,"sourceCodeEnd":756,"githubUrl":"https://github.com/gohugoio/hugo/blob/8a468df065a75c1c7cf9f6850f32148746590ea5/commands/server.go#L720-L756","documentation":"After successfully PEM-decoding the cached TLS certificate, Hugo calls `x509.ParseCertificate` on the DER bytes. This error means the PEM block decoded but its payload is not a valid X.509 certificate — the block may be of the wrong type (e.g. a private key) or the DER data is corrupt.","triggerScenarios":"`hugo server --tlsAuto` where `<cacheDir>/_mkcerts/<hostname>.pem` contains a PEM block whose bytes fail X.509 parsing — swapped cert/key files, a `PRIVATE KEY` block where the certificate should be, or bit-rot in the cached file.","commonSituations":"Accidentally copying the `-key.pem` content into the cert file; scripts that concatenate or rewrite cert files incorrectly; corrupted cache after crashes or sync conflicts.","solutions":["Delete `<hugo cacheDir>/_mkcerts/` and rerun `hugo server --tlsAuto` to regenerate the pair.","If managing certs manually, confirm the cert file holds a `CERTIFICATE` block, not a key: `openssl x509 -in file.pem -noout -subject`.","Ensure cert and key files weren't swapped (`<host>.pem` = cert, `<host>-key.pem` = key)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(certBytes)\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    return fmt.Errorf(\"corrupt certificate: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate certs with openssl before pointing hugo at them","Regenerate rather than repair corrupted certificates","Watch for line-ending or copy-paste corruption in PEM files"],"tags":["tls","x509","hugo-server","certificates"],"analyzedSha":"8a468df065a75c1c7cf9f6850f32148746590ea5","analyzedAt":"2026-07-31T21:23:07.045Z","schemaVersion":2}