error:0480006C:PEM routines::no start line

Reproduced via Node 26's X509Certificate on garbage input. OpenSSL 1.1.x printed the same failure as "error:0906D06C:PEM routines:PEM_read_bio:no start line". A related sibling: "error:04800066:PEM routines::bad end line" when the END marker is damaged.

OpenSSL 3.x — also surfaces in Node as ERR_OSSL_PEM_NO_START_LINE

What it means

A PEM parser scanned the input for a "-----BEGIN ...-----" line matching the object it expects and never found one. Either the file is not PEM at all (binary DER, JSON, empty), or the BEGIN label names a different object than the parser wants, or invisible characters corrupted the framing.

Why it happens

• DER (binary) data fed to a PEM parser

  common

  .der/.cer/.pfx files are binary; they contain no BEGIN line by definition. Tools default to PEM, so binary inputs land exactly here.

• Label mismatch: right file, wrong object

  common

  Parsers look for their own label. Code reading certificates skips "-----BEGIN PRIVATE KEY-----" blocks entirely and reports no start line — technically true: no CERTIFICATE start line exists.

• Framing broken by transport

  common

  Literal \n sequences from env vars/JSON, a UTF-8 BOM before the first dash, Windows CRLF in strict parsers, smart-quote dashes from a document editor, or a missing final newline all prevent the regex-like BEGIN match.

How to fix it

1. 1.

   Look at the first bytes

   One xxd line distinguishes PEM (ASCII dashes), DER (0x30 first byte) and garbage. Then convert or fix accordingly.

   head -c 32 file | xxd
   # 2d 2d 2d 2d 2d ("-----")  → PEM: check the label matches what the tool expects
   # 30 82 ...                  → DER: add -inform der or convert:
   openssl x509 -inform der -in cert.der -out cert.pem

2. 2.

   Repair transport-mangled PEM

   Restore newlines and strip BOM/CR. After repair the BEGIN line must be exactly five dashes, the label, five dashes.

   printf '%s' "$PEM_VAR" | sed 's/\\n/\n/g' | sed '1s/^\xef\xbb\xbf//' | tr -d '\r' > fixed.pem
   head -1 fixed.pem   # -----BEGIN CERTIFICATE-----

3. 3.

   In Node, normalize before parsing

   The same error appears as code ERR_OSSL_PEM_NO_START_LINE from X509Certificate and key loaders; the env-var newline fix solves most cases.

   import { X509Certificate } from "node:crypto";
   const cert = new X509Certificate(process.env.CERT_PEM.replace(/\\n/g, "\n"));

← Browse the full signature error database