TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot update private key: no such private key was found.

Error message

Cannot update private key: no such private key was found.

What it means

Thrown by UpdatePrivateKey when _dnssecPrivateKeys.TryGetValue fails for the supplied keyTag. The dictionary is keyed by KeyTag, so an unknown tag cannot be updated.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:1080

        public void AddPrivateKey(DnssecPrivateKey privateKey)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The primary zone must be signed.");

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryAdd(privateKey.KeyTag, privateKey))
                    throw new DnsServerException($"Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")} private key: key tag collision. Please generate another private key and try again.");
            }
        }

        public DnssecPrivateKey UpdatePrivateKey(ushort keyTag, ushort rolloverDays)
        {
            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot update private key: no such private key was found.");

                privateKey.RolloverDays = rolloverDays;

                return privateKey;
            }
        }

        public void DeletePrivateKey(ushort keyTag)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot delete private key: no such private key was found.");

                if (privateKey.State != DnssecPrivateKeyState.Generated)

View on GitHub (pinned to d0484b6c1e)

Solutions

1. List the zone's DnssecPrivateKeys and confirm the keyTag exists before updating.
2. If the key was removed, regenerate or re-add it instead of updating.
3. Validate that the keyTag returned by a prior Generate/Add call is the one you pass.

Example fix

// before
zone.UpdatePrivateKey(keyTag, rolloverDays: 365);

// after
var keys = zone.DnssecPrivateKeys;
var match = keys.FirstOrDefault(k => k.KeyTag == keyTag);
if (match is null)
    throw new ArgumentException($"No private key with KeyTag {keyTag}.");
zone.UpdatePrivateKey(keyTag, rolloverDays: 365);

// Verify the keyTag exists before updating
var key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);
if (key is null)
    throw new ArgumentException($"No private key with KeyTag {keyTag}.");
zone.UpdatePrivateKey(keyTag, rolloverDays);

static bool KeyTagExists(ApexZone zone, ushort keyTag) =>
    zone.DnssecPrivateKeys.Any(k => k.KeyTag == keyTag);

try
{
    zone.UpdatePrivateKey(keyTag, rolloverDays);
}
catch (DnsServerException ex) when (ex.Message.Contains("no such private key was found"))
{
    // refresh the key list; the tag is stale or from another zone
}

When it happens

Trigger: Calling UpdatePrivateKey(keyTag, rolloverDays) with a keyTag that is not present in the zone's private key set.

Common situations: Passing a stale keyTag from an older config, a UI form bug sending 0, or a race where the key was deleted between listing and updating.

Related errors

• The primary zone must be signed.
• Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.K
• The zone must be signed.
• Cannot delete private key: no such private key was found.
• Cannot delete private key: only keys with Generated state ca

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/ceab5a11477d1674. Report an issue: GitHub.