apache/beam · error · java.lang.RuntimeException

Private key encryption algorithm not supported. This may…

Error message

Private key encryption algorithm not supported. This may mean that the private key was generated by OpenSSL 1.1.1g or newer which uses an encryption algorithm by default which has compatibility issues in some JVM environments. For details, see: https://community.snowflake.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID + e.getMessage()

What it means

While decrypting an encrypted PKCS#8 private key, SecretKeyFactory.getInstance throws NoSuchAlgorithmException when the JVM lacks the key's PBE encryption algorithm. The library wraps it in this RuntimeException pointing to Snowflake's known OpenSSL 1.1.1g+ compatibility article.

Solutions

1. Regenerate the key unencrypted: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-nocrypt.pem and drop the passphrase.
2. Regenerate the key with a widely supported algorithm: openssl pkcs8 -topk8 -v1 PBE-SHA1-3DES.
3. Use Snowflake's suggested conversion per the linked article (decrypt/re-encrypt with openssl pkcs8 -topk8).
4. Run on a JVM/JCE provider that supports the algorithm, or add a provider like BouncyCastle.

Example fix

// before (shell)
openssl genpkey -algorithm RSA -aes256 -out key.pem
// after (shell)
openssl genpkey -algorithm RSA -out key.pem   # or re-encrypt with -v1 PBE-SHA1-3DES

// Probe JVM support before using the key
try {
  SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
} catch (NoSuchAlgorithmException e) {
  throw new IllegalStateException("JVM lacks PBE support; regenerate key with -v1 PBE-SHA1-3DES");
}

try {
  PrivateKey pk = KeyPairUtils.preparePrivateKey(pem, passphrase);
} catch (RuntimeException e) {
  if (e.getMessage().startsWith("Private key encryption algorithm not supported")) {
    // fall back: re-encrypt key with openssl -v1 PBE-SHA1-3DES or use unencrypted key
  }
  throw e;
}

When it happens

Trigger: Loading an encrypted private key generated with OpenSSL 1.1.1g or newer (default PBES2/AES-256-CBC with PBKDF2) on a JVM whose SecretKeyFactory doesn't support that algorithm, via preparePrivateKey.

Common situations: Java 8 or restricted JCE environments; keys generated on modern Linux (OpenSSH/OpenSSL) then used in JVMs lacking the newer algorithms; FIPS-enabled JVMs.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Can't create private key: + e.getMessage()
• Can't read parse private key
• Can't read private key from provided path
• Invalid type of PEM file: + pemObject.getType() + …
• The private key is encrypted but no private key key…

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/c2ec97d77f6546b6. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java:93

        decoded = pemObject.getContent();
        pr.close();
      }

      if (Strings.isNullOrEmpty(privateKeyPassphrase)) {
        // unencrypted private key file
        PKCS8EncodedKeySpec encodedKeySpec = new PKCS8EncodedKeySpec(decoded);
        return keyFactory.generatePrivate(encodedKeySpec);
      } else {
        // encrypted private key file
        EncryptedPrivateKeyInfo pkInfo = new EncryptedPrivateKeyInfo(decoded);
        PBEKeySpec keySpec = new PBEKeySpec(privateKeyPassphrase.toCharArray());
        SecretKeyFactory pbeKeyFactory = SecretKeyFactory.getInstance(pkInfo.getAlgName());
        PKCS8EncodedKeySpec encodedKeySpec =
            pkInfo.getKeySpec(pbeKeyFactory.generateSecret(keySpec));
        return keyFactory.generatePrivate(encodedKeySpec);
      }
    } catch (NoSuchAlgorithmException e) {
      throw new RuntimeException(
          "Private key encryption algorithm not supported. This may mean that the private key was generated by OpenSSL 1.1.1g or newer "
              + "which uses an encryption algorithm by default which has compatibility issues in some JVM environments. "
              + "For details, see: "
              + "https://community.snowflake.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID"
              + " "
              + e.getMessage());
    } catch (InvalidKeySpecException
        | IOException
        | IllegalArgumentException
        | NullPointerException
        | InvalidKeyException
        | DecoderException e) {
      throw new RuntimeException("Can't create private key: " + e.getMessage(), e);
    }
  }

  /**
   * Tries to determine whether the private key is encrypted or not based on the file headers.

View on GitHub (pinned to 12126d8942)