TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot update private key: no such private key was found.

Error message

Cannot update private key: no such private key was found.

What it means

Thrown by UpdatePrivateKey when _dnssecPrivateKeys.TryGetValue fails for the supplied keyTag. The dictionary is keyed by KeyTag, so an unknown tag cannot be updated.

Solutions

1. List the zone's DnssecPrivateKeys and confirm the keyTag exists before updating.
2. If the key was removed, regenerate or re-add it instead of updating.
3. Validate that the keyTag returned by a prior Generate/Add call is the one you pass.

Example fix

// before
zone.UpdatePrivateKey(keyTag, rolloverDays: 365);

// after
var keys = zone.DnssecPrivateKeys;
var match = keys.FirstOrDefault(k => k.KeyTag == keyTag);
if (match is null)
    throw new ArgumentException($"No private key with KeyTag {keyTag}.");
zone.UpdatePrivateKey(keyTag, rolloverDays: 365);

// Verify the keyTag exists before updating
var key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);
if (key is null)
    throw new ArgumentException($"No private key with KeyTag {keyTag}.");
zone.UpdatePrivateKey(keyTag, rolloverDays);

static bool KeyTagExists(ApexZone zone, ushort keyTag) =>
    zone.DnssecPrivateKeys.Any(k => k.KeyTag == keyTag);

try
{
    zone.UpdatePrivateKey(keyTag, rolloverDays);
}
catch (DnsServerException ex) when (ex.Message.Contains("no such private key was found"))
{
    // refresh the key list; the tag is stale or from another zone
}

When it happens

Trigger: Calling UpdatePrivateKey(keyTag, rolloverDays) with a keyTag that is not present in the zone's private key set.

Common situations: Passing a stale keyTag from an older config, a UI form bug sending 0, or a race where the key was deleted between listing and updating.

Related errors

• Cannot activate private key: no such private key was found.
• Cannot delete private key: no such private key was found.
• Cannot delete private key: only keys with Generated state…
• Cannot publish DNSKEY: no generated private keys were found.
• Cannot publish DNSKEY: the key is already published.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/ceab5a11477d1674. Report an issue: GitHub.

Appendix: source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:1080

        public void AddPrivateKey(DnssecPrivateKey privateKey)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The primary zone must be signed.");

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryAdd(privateKey.KeyTag, privateKey))
                    throw new DnsServerException($"Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")} private key: key tag collision. Please generate another private key and try again.");
            }
        }

        public DnssecPrivateKey UpdatePrivateKey(ushort keyTag, ushort rolloverDays)
        {
            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot update private key: no such private key was found.");

                privateKey.RolloverDays = rolloverDays;

                return privateKey;
            }
        }

        public void DeletePrivateKey(ushort keyTag)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot delete private key: no such private key was found.");

                if (privateKey.State != DnssecPrivateKeyState.Generated)

View on GitHub (pinned to d0484b6c1e)