apache/beam · error · java.lang.RuntimeException

The private key is unencrypted but private key key…

Error message

The private key is unencrypted but private key key passphrase has been provided.

What it means

preparePrivateKey validates passphrase consistency: if the PEM key is unencrypted but a non-empty passphrase was supplied, it throws this RuntimeException. The passphrase would be silently ignored otherwise, which the library treats as a configuration mistake.

Solutions

1. Remove the privateKeyPassphrase from the Snowflake configuration since the key is not encrypted.
2. Or, if you intend to use a passphrase, regenerate the key encrypted: openssl genpkey -aes256 ... / openssl pkcs8 -topk8 -v2 aes-256-cbc.
3. Verify the key's header: '-----BEGIN PRIVATE KEY-----' means unencrypted; '-----BEGIN ENCRYPTED PRIVATE KEY-----' means encrypted.

Example fix

// before (key is unencrypted)
config.withPrivateKeyPassphrase("mypassword")

// after
config // passphrase property removed entirely

boolean encrypted = pem.contains("BEGIN ENCRYPTED PRIVATE KEY");
if (!encrypted && passphrase != null && !passphrase.isEmpty()) {
  throw new IllegalStateException("Passphrase set but key is unencrypted");
}

When it happens

Trigger: Passing privateKeyPassphrase to preparePrivateKey while the PEM file has the "PRIVATE KEY" (unencrypted) header — typically configured via Snowflake's privateKeyPassphrase property for a key without encryption.

Common situations: Config template always includes a passphrase field left filled with a dummy value; switching to an unencrypted key without removing the passphrase setting; copy-pasted config from another environment.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• The private key is encrypted but no private key key…
• privateKeyPassphrase requires privateKey.
• Can't create private key: + e.getMessage()
• Can't read parse private key
• Can't read private key from provided path

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/4c0ec2bc4d613e88. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java:64

    ENCRYPT,
    UNENCRYPTED,
    UNKNOWN
  }

  @SuppressFBWarnings("DCN_NULLPOINTER_EXCEPTION")
  public static PrivateKey preparePrivateKey(String privateKey, String privateKeyPassphrase) {
    try {
      KeyFactory keyFactory = KeyFactory.getInstance("RSA");
      KeyEncryptionState encryptionState = guessKeyEncryptionState(privateKey);
      if (encryptionState == KeyEncryptionState.ENCRYPT
          && Strings.isNullOrEmpty(privateKeyPassphrase)) {
        throw new RuntimeException(
            "The private key is encrypted but no private key key passphrase has been provided.");
      }

      if (encryptionState == KeyEncryptionState.UNENCRYPTED
          && !Strings.isNullOrEmpty(privateKeyPassphrase)) {
        throw new RuntimeException(
            "The private key is unencrypted but private key key passphrase has been provided.");
      }

      byte[] decoded;

      if (encryptionState == KeyEncryptionState.UNKNOWN) {
        decoded = Base64.decode(privateKey);
      } else {
        PemReader pr = new PemReader(new StringReader(privateKey));
        PemObject pemObject = pr.readPemObject();
        decoded = pemObject.getContent();
        pr.close();
      }

      if (Strings.isNullOrEmpty(privateKeyPassphrase)) {
        // unencrypted private key file
        PKCS8EncodedKeySpec encodedKeySpec = new PKCS8EncodedKeySpec(decoded);
        return keyFactory.generatePrivate(encodedKeySpec);

View on GitHub (pinned to 12126d8942)