apache/beam · error · java.lang.RuntimeException

Invalid type of PEM file: + pemObject.getType() + …

Error message

Invalid type of PEM file: + pemObject.getType() + . Supported types: + ENCRYPTED_PRIVATE_KEY + , + UNENCRYPTED_PRIVATE_KEY

What it means

guessKeyEncryptionState reads the PEM header to classify the key. If pemObject.getType() is neither "ENCRYPTED PRIVATE KEY" nor "UNENCRYPTED PRIVATE KEY", it throws this RuntimeException naming the actual type and the supported ones.

Solutions

Convert PKCS#1 to PKCS#8: openssl pkcs8 -topk8 -in key.pem -out key.p8 (add -nocrypt if unencrypted, or -v2 aes-256-cbc / -v1 PBE-SHA1-3DES for encryption).
Ensure you are loading the private key file, not the .pub file or a certificate.
Open the PEM and confirm the header is '-----BEGIN ENCRYPTED PRIVATE KEY-----' or '-----BEGIN PRIVATE KEY-----'; re-export from the source if not.

Example fix

// before (shell): PKCS#1 key
-----BEGIN RSA PRIVATE KEY----- ...
// after (shell conversion)
openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.p8  # header becomes -----BEGIN PRIVATE KEY-----

Defensive patterns

Strategy: validation

Validate before calling

if (!pem.contains("BEGIN ENCRYPTED PRIVATE KEY") && !pem.contains("BEGIN PRIVATE KEY")) {
  throw new IllegalArgumentException("Convert key to PKCS#8: openssl pkcs8 -topk8 -in key.pem -out key.p8");
}

Try / catch

try {
  PrivateKey pk = KeyPairUtils.preparePrivateKey(pem, passphrase);
} catch (RuntimeException e) {
  if (e.getMessage().startsWith("Invalid type of PEM file")) {
    // convert PKCS#1 -> PKCS#8 with openssl pkcs8 -topk8 and retry
  }
  throw e;
}

Prevention

Convert all legacy PKCS#1 (RSA PRIVATE KEY) keys to PKCS#8.
Never pass public keys or certificates where a private key is expected.
Check the PEM header type before configuring Snowflake key-pair auth.

When it happens

Trigger: Passing a PEM with a legacy or different header: "RSA PRIVATE KEY" (PKCS#1), "PRIVATE KEY" (unparsed), a PUBLIC KEY, or a CERTIFICATE to preparePrivateKey/guessKeyEncryptionState.

Common situations: Using an old PKCS#1 key from ssh-keygen/legacy openssl; accidentally pointing at the .pub file or a certificate; keys converted with the wrong openssl flags.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/75baad9739c803ed. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java:129

   * Tries to determine whether the private key is encrypted or not based on the file headers.
   *
   * <p>If this is not possible (e.g. there are no headers), returns {@link
   * KeyEncryptionState#UNKNOWN}
   */
  private static KeyEncryptionState guessKeyEncryptionState(String privateKey) {
    PemReader pr = new PemReader(new StringReader(privateKey));
    try {
      PemObject pemObject = pr.readPemObject();
      if (pemObject == null) {
        // If it is not a PEM file then it is not possible to determine the encryption state
        return KeyEncryptionState.UNKNOWN;
      }
      if (ENCRYPTED_PRIVATE_KEY.equals(pemObject.getType())) {
        return KeyEncryptionState.ENCRYPT;
      } else if (UNENCRYPTED_PRIVATE_KEY.equals(pemObject.getType())) {
        return KeyEncryptionState.UNENCRYPTED;
      } else {
        throw new RuntimeException(
            "Invalid type of PEM file: "
                + pemObject.getType()
                + ". Supported types: "
                + ENCRYPTED_PRIVATE_KEY
                + ", "
                + UNENCRYPTED_PRIVATE_KEY);
      }
    } catch (IOException e) {
      throw new RuntimeException("Can't read parse private key");
    }
  }

  public static String readPrivateKeyFile(String privateKeyPath) {
    try {
      byte[] keyBytes = Files.readAllBytes(Paths.get(privateKeyPath));
      return new String(keyBytes, StandardCharsets.UTF_8);
    } catch (IOException e) {
      throw new RuntimeException("Can't read private key from provided path");

View on GitHub (pinned to 12126d8942)