TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot activate private key: no such private key was found.

Error message

Cannot activate private key: no such private key was found.

What it means

Thrown by ActivateKskDnsKey when _dnssecPrivateKeys.TryGetValue fails for the supplied keyTag. You can only activate a KSK that the zone actually holds.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:1228

                    dnsKeyTags = privateKey.KeyTag.ToString();
                else
                    dnsKeyTags += ", " + privateKey.KeyTag.ToString();
            }

            _dnsServer.LogManager.Write("The ZSK DNSKEYs (" + dnsKeyTags + ") from the primary zone were activated successfully: " + ToString());
        }

        public void ActivateKskDnsKey(ushort keyTag)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

            DnssecPrivateKey privateKey;

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out privateKey))
                    throw new DnsServerException("Cannot activate private key: no such private key was found.");
            }

            if (privateKey.KeyType != DnssecPrivateKeyType.KeySigningKey)
                throw new DnsServerException("Cannot activate private key: only a Key Signing Key (KSK) can be activated.");

            if (privateKey.State != DnssecPrivateKeyState.Ready)
                throw new DnsServerException("Cannot activate private key: the Key Signing Key (KSK) must be in 'Ready' state.");

            if (privateKey.IsRetiring)
                throw new DnsServerException("Cannot activate private key: the Key Signing Key (KSK) is already set to retire.");

            privateKey.SetState(DnssecPrivateKeyState.Active);
        }

        public void RolloverDnsKey(ushort keyTag)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Confirm the keyTag exists in zone.DnssecPrivateKeys before activating.
2. Ensure the target key's KeyType is KeySigningKey and its State is Ready before calling.
3. Refresh the key listing and use the tag returned by GenerateAndAddPrivateKey or AddPrivateKey.

Example fix

// before
zone.ActivateKskDnsKey(keyTag);

// after
var key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);
if (key is null)
    throw new ArgumentException($"No private key with KeyTag {keyTag}.");
if (key.KeyType != DnssecPrivateKeyType.KeySigningKey)
    throw new ArgumentException($"Key {keyTag} is not a KSK.");
zone.ActivateKskDnsKey(keyTag);

// Verify the keyTag exists and is a KSK before activating
var key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);
if (key is null)
    throw new ArgumentException($"No private key with KeyTag {keyTag}.");
if (key.KeyType != DnssecPrivateKeyType.KeySigningKey)
    throw new ArgumentException($"Key {keyTag} is not a KSK.");
zone.ActivateKskDnsKey(keyTag);

static bool IsActivatableKsk(DnssecPrivateKey key) =>
    key.KeyType == DnssecPrivateKeyType.KeySigningKey
    && key.State == DnssecPrivateKeyState.Ready
    && !key.IsRetiring;

try
{
    zone.ActivateKskDnsKey(keyTag);
}
catch (DnsServerException ex) when (ex.Message.Contains("no such private key was found"))
{
    // refresh the key list; the tag is stale or from another zone
}

When it happens

Trigger: Calling ActivateKskDnsKey with a keyTag not present in the zone's private key set.

Common situations: Passing a keyTag from a different zone, a stale tag, or 0 due to an uninitialised variable.

Related errors

• The primary zone must be signed.
• Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.K
• Cannot update private key: no such private key was found.
• The zone must be signed.
• Cannot delete private key: no such private key was found.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/77e13681a15cfff5. Report an issue: GitHub.