apache/cassandra · error · GeneralSecurityException

The given private key could not be parsed with any of the su

Error message

The given private key could not be parsed with any of the supported algorithms. Please see PEMReader#SUPPORTED_PRIVATE_KEY_ALGORITHMS.

What it means

PEMReader parses PEM private keys by brute-force trying each KeyFactory in SUPPORTED_PRIVATE_KEY_ALGORITHMS (RSA, DSA, EC) against the PKCS#8-encoded key bytes. When every algorithm fails to generate a private key, this GeneralSecurityException is thrown. It means the key is not a valid PKCS#8 RSA/DSA/EC private key (or is corrupted / of an unsupported algorithm such as Ed25519).

Source

Thrown at src/java/org/apache/cassandra/security/PEMReader.java:165

         * actual algorithm of the private key. For doing that, we have to use some special library like BouncyCastle.
         * However in the absence of that, below brute-force approach can work- that is to try out all the supported
         * private key algorithms given that there are only three major algorithms to verify against.
         */
        for (String privateKeyAlgorithm : SUPPORTED_PRIVATE_KEY_ALGORITHMS)
        {
            try
            {
                privateKey = KeyFactory.getInstance(privateKeyAlgorithm).generatePrivate(keySpec);
                logger.info("Parsing for the private key finished with {} algorithm.", privateKeyAlgorithm);
                return privateKey;
            }
            catch (Exception e)
            {
                logger.debug("Failed to parse the private key with {} algorithm. Will try the other supported " +
                             "algorithms.", privateKeyAlgorithm);
            }
        }
        throw new GeneralSecurityException("The given private key could not be parsed with any of the supported " +
                                           "algorithms. Please see PEMReader#SUPPORTED_PRIVATE_KEY_ALGORITHMS.");
    }

    /**
     * Extracts the certificates/cert-chain from the PEM content.
     *
     * @param pemCerts certificates/cert-chain stored as PEM content
     * @return X509 certiificate list
     * @throws GeneralSecurityException in case any issue encountered while reading the certificates
     */
    public static Certificate[] extractCertificates(String pemCerts) throws GeneralSecurityException
    {
        List<Certificate> certificateList = new ArrayList<>();
        List<String> base64EncodedCerts = extractBase64EncodedCerts(pemCerts);
        for (String base64EncodedCertificate : base64EncodedCerts)
        {
            certificateList.add(generateCertificate(base64EncodedCertificate));
        }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Convert the key to unencrypted PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem
2. Check debug logs — each per-algorithm failure is logged at DEBUG ('Failed to parse the private key with X algorithm') to see why parsing failed
3. Verify the key file is intact and not truncated (check BEGIN/END lines and base64 body); re-export the key if it came through a copy/paste or templating system that mangled line breaks
4. If the key is encrypted, pass the correct keyPassword so decryption yields valid PKCS#8 bytes; if unencrypted, ensure no password is passed
5. If the key uses an unsupported algorithm (e.g. Ed25519), regenerate the key with RSA, DSA, or EC

Example fix

// before (PKCS#1 key that PEMReader rejects)
openssl genrsa -out cassandra.key 2048   # 'BEGIN RSA PRIVATE KEY' (PKCS#1)
// after (convert to PKCS#8 which PEMReader requires)
openssl genrsa -out cassandra.key 2048
openssl pkcs8 -topk8 -nocrypt -in cassandra.key -out cassandra-pkcs8.key

// Validate the PEM key is PKCS#8 and parseable before handing it to PEMReader
static void validatePemKey(String pem, String password) throws Exception {
    if (pem == null || !pem.contains("PRIVATE KEY"))
        throw new IllegalArgumentException("Not a PEM private key block");
    try {
        PEMReader.extractPrivateKey(pem, password);
    } catch (GeneralSecurityException e) {
        throw new IllegalArgumentException("Key must be PKCS#8 with algorithm RSA, DSA or EC; " +
            "convert with: openssl pkcs8 -topk8 -in key.pem -out key-pkcs8.pem", e);
    }
}

try {
    PrivateKey key = PEMReader.extractPrivateKey(pemKey, keyPassword);
} catch (GeneralSecurityException e) {
    logger.error("Private key not parseable as PKCS#8 RSA/DSA/EC - check key format/algorithm", e);
    throw new ConfigurationException("Invalid SSL private key; convert to PKCS#8", e);
}

When it happens

Trigger: Calling PEMReader.extractPrivateKey(pemKey[, password]) where the decrypted DER bytes cannot be parsed by the RSA, DSA, or EC KeyFactory — e.g. the key is PKCS#1 ('BEGIN RSA PRIVATE KEY' raw) rather than PKCS#8, uses an unsupported algorithm (EdDSA/Ed25519), is truncated/corrupted, or the password was given for an unencrypted key (or vice versa) so decryption yields garbage.

Common situations: Configuring cassandra.yaml client/server encryption with a PEM key generated by openssl without 'pkcs8' conversion; a legacy OpenSSL 1.0-style key; supplying the wrong keyPassword (note: wrong password on PBE keys may instead surface as a decrypt error, but a partially-corrupt decrypt here); keys for newer algorithms like Ed25519 that the three supported factories reject; YAML-encoded key with mangled newlines.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid private key format
• Invalid certificate format
• Failed to decode given base64 input. msg=
• Setting require_client_auth is incompatible with 'rack' and
• PEM based truststore should not be using password. Ignoring

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/dba820367a3dbc73. Report an issue: GitHub.