SonarSource/sonarqube · error · IllegalArgumentException

The Github App private key is not valid

Error message

The Github App private key is not valid

What it means

Thrown by GithubAppSecurityImpl.readApplicationPrivateKey when constructing the RSA256 JWT signing algorithm fails for any reason (bad PKCS8 spec, invalid RSA key material, provider errors). It wraps the underlying exception as an IllegalArgumentException.

Source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/security/GithubAppSecurityImpl.java:100

      PrivateKey privateKey = keyFactory.generatePrivate(keySpec1);
      return Algorithm.RSA256(new RSAKeyProvider() {
        @Override
        public RSAPublicKey getPublicKeyById(String keyId) {
          throw new UnsupportedOperationException("getPublicKeyById not implemented");
        }

        @Override
        public RSAPrivateKey getPrivateKey() {
          return (RSAPrivateKey) privateKey;
        }

        @Override
        public String getPrivateKeyId() {
          return "github_app_" + appId;
        }
      });
    } catch (Exception e) {
      throw new IllegalArgumentException("The Github App private key is not valid", e);
    } finally {
      Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
    }
  }

}

View on GitHub (pinned to 184c821202)

Solutions

1. Convert the key to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key_pkcs8.pem and reconfigure
2. Re-download the GitHub App .pem private key and paste it unchanged
3. Check the underlying wrapped exception (getCause) for the exact crypto failure

Example fix

// before: -----BEGIN RSA PRIVATE KEY----- (PKCS#1, unsupported parse path)
// after: openssl pkcs8 -topk8 -nocrypt -in app-key.pem -> -----BEGIN PRIVATE KEY-----

openssl pkcs8 -topk8 -nocrypt -in app-private-key.pem -out app-private-key.pkcs8.pem  # run before uploading

try { githubAppSecurity.algorithm(appId, key); } catch (IllegalArgumentException e) { inspect(e.getCause()); // underlying crypto failure
}

When it happens

Trigger: readApplicationPrivateKey (via algorithm) parses a PEM block successfully but KeyFactory.getInstance("RSA").generatePrivate(...) throws (malformed DER, unsupported key format like OpenSSH or PKCS1), or Algorithm.RSA256 setup fails.

Common situations: User uploaded a PKCS#1 'BEGIN RSA PRIVATE KEY' key, an encrypted key, or an SSH-format key; key file corrupted; wrong key copied (not the GitHub App's .pem).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Failed to decode Github Application private key
• Missing URL
• Invalid URL, %s
• Only http and https schemes are supported
• Invalid GitHub URL

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/d49f5538d35591a5. Report an issue: GitHub.