Securityflags: g

PEM Certificate Block

Match PEM-encoded certificate and key blocks, capturing the block type and base64 content.

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("-----BEGIN ([A-Z ]+)-----([\\s\\S]+?)-----END \\1-----", "g");
const input = "-----BEGIN CERTIFICATE-----\\nMIIBkTCB+...\\n-----END CERTIFICATE-----";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"-----BEGIN ([A-Z ]+)-----([\s\S]+?)-----END \1-----")
input_text = "-----BEGIN CERTIFICATE-----\nMIIBkTCB+...\n-----END CERTIFICATE-----"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Why it doesn't work in GO

Go's RE2 engine doesn't support backreferences (`\1`, `\2`, …) for the same linear-time reason.

Approach

Match the candidate substring with a single capture, then verify the duplication in code; or use JS / Python which both support backreferences.

Read the full guide →

Workaround code in Go (RE2)

goGo (workaround)

package main

import (
	"fmt"
	"regexp"
)

// RE2 doesn't support backreferences. The fix: capture the candidate
// substring once, then verify the duplication in Go code.
//
// Example: instead of `(\w+)\s+\1` (duplicate words), capture two
// adjacent words and compare them.

func main() {
	re := regexp.MustCompile(`\b(\w+)\s+(\w+)\b`)
	input := "the cat cat ran ran fast"
	for _, m := range re.FindAllStringSubmatch(input, -1) {
		if m[1] == m[2] { // the backreference equality, in code
			fmt.Println(m[0])
		}
	}
}

Capture the candidate substrings as separate groups, then compare them in Go code instead of via a backreference.

Pattern

regexengine-agnostic

-----BEGIN ([A-Z ]+)-----([\s\S]+?)-----END \1-----   (flags: g)

Raw source: -----BEGIN ([A-Z ]+)-----([\s\S]+?)-----END \1-----

How it works

-----BEGIN ([A-Z ]+)----- captures the block type label (e.g. CERTIFICATE, RSA PRIVATE KEY). ([\s\S]+?) lazily captures the multiline base64 body. \1 back-references the type to ensure BEGIN and END labels match. The dotAll behaviour requires [\s\S] in JS (or /s flag in newer JS) and re.DOTALL in Python.