diff --git a/cmd/cloudflared/tunnel/subcommand_context.go b/cmd/cloudflared/tunnel/subcommand_context.go
index 6f3cca20..130f4fa6 100644
--- a/cmd/cloudflared/tunnel/subcommand_context.go
+++ b/cmd/cloudflared/tunnel/subcommand_context.go
@@ -120,6 +120,12 @@ func (sc *subcommandContext) readTunnelCredentials(tunnelID uuid.UUID) (*pogs.Tu
 
 	var auth pogs.TunnelAuth
 	if err = json.Unmarshal(body, &auth); err != nil {
+		if strings.HasSuffix(filePath, ".pem") {
+			return nil, fmt.Errorf("The tunnel credentials file should be .json but you gave a .pem. "+
+				"The tunnel credentials file was originally created by `cloudflared tunnel create` and named %s.json."+
+				"You may have accidentally used the filepath to cert.pem, which is generated by `cloudflared tunnel "+
+				"login`.", tunnelID)
+		}
 		return nil, errInvalidJSONCredential{path: filePath, err: err}
 	}
 	return &auth, nil