Error loading TLS certificates from single line

[jscancella]

Component(s)

No response

What happened?

Describe the bug
When loading the cert_pem and key_pem from a single line (using \n character to delimit the needed newlines) it fails to understand the cert

Steps to reproduce
reformat SSL cert and key to a single line using \n to replacement newline

What did you expect to see?
SSL cert and key are accepted. It would greatly help being able to pull from systems that only allow for a single line per key.

What did you see instead?

Error: cannot start pipelines: failed to start "otlp" receiver: failed to load TLS config: failed to load TLS cert and key: failed to load TLS cert and key PEMs: tls: failed to find any PEM data in certificate input
2025/05/05 17:59:33 collector server run finished with error: cannot start pipelines: failed to start "otlp" receiver: failed to load TLS config: failed to load TLS cert and key: failed to load TLS cert and key PEMs: tls: failed to find any PEM data in certificate input

Dockerfile.txt

Collector version

0.123.0

Environment information

Environment

OS: docker container on AWS ECS fargate

OpenTelemetry Collector configuration

receivers:
    otlp:
        protocols:
            http:
                endpoint: 0.0.0.0:4318
                tls:
                    cert_pem: ${CERT_PEM}
                    key_pem: ${KEY_PEM}
                    ca_file: /etc/ssl/certs/ca-certificates.crt

exporters:
    debug:
        verbosity: detailed

service:
    pipelines:
        traces:
            receivers: [otlp]
            processors: []
            exporters: [debug]

Log output

PS C:\Users\John\Documents\repos\otel-collector> docker run --rm -it foo
2025-05-05T17:59:33.290Z        info    service@v0.123.0/service.go:197 Setting up own telemetry...
2025-05-05T17:59:33.290Z        info    builders/builders.go:26 Development component. May change in the future.
2025-05-05T17:59:33.291Z        info    service@v0.123.0/service.go:264 Starting otelcol-contrib...     {"Version": "0.123.0", "NumCPU": 12}
2025-05-05T17:59:33.291Z        info    extensions/extensions.go:41     Starting extensions...
2025-05-05T17:59:33.291Z        info    otlpreceiver@v0.123.0/otlp.go:173       Starting HTTP server    {"endpoint": "0.0.0.0:4318"}
2025-05-05T17:59:33.293Z        error   graph/graph.go:438      Failed to start component       {"error": "failed to load TLS config: failed to load TLS cert and key: failed to load TLS cert and key PEMs: tls: failed to find any PEM data in certificate input", "type": "Receiver", "id": "otlp"}
2025-05-05T17:59:33.293Z        info    service@v0.123.0/service.go:329 Starting shutdown...
2025-05-05T17:59:33.293Z        info    extensions/extensions.go:69     Stopping extensions...
2025-05-05T17:59:33.293Z        info    service@v0.123.0/service.go:343 Shutdown complete.
Error: cannot start pipelines: failed to start "otlp" receiver: failed to load TLS config: failed to load TLS cert and key: failed to load TLS cert and key PEMs: tls: failed to find any PEM data in certificate input
2025/05/05 17:59:33 collector server run finished with error: cannot start pipelines: failed to start "otlp" receiver: failed to load TLS config: failed to load TLS cert and key: failed to load TLS cert and key PEMs: tls: failed to find any PEM data in certificate input

Additional context

No response

[jangaraj]

reformat SSL cert and key to a single line using \n to replacement newline

Is there any RFC, which specify this format?

[cchiriac-dic]

I have this issue as well on otel-collector 0.130.0 . But works fine on 0.138.0. Was this solved on a specific version ?

[jscancella]

@cchiriac-dic I ended up putting it in parameter store in AWS instead of secret manager and that worked for me.

[dmathieu]

@cchiriac-dic the changelog doesn't include anything specific about this. So this might be a side effect fix.
Could you try pinpointing the exact version this was fixed in?

[cchiriac-dic]

Thanks for the answers. In the meantime I've found out the issue was caused by azure keyvault. It only accepts multiline secrets from cli. When doing it through the ui like I did, it formats everything on one line. I was so focused on everything else that this was the last thing I've checked.
https://medium.com/@tarun.rajnish/uploading-multi-line-secrets-to-azure-key-vault-1b3bb95e292d

[dmathieu]

Good. I'll close this issue then.