{"record":{"id":"00e6842f5de6e4d7","repo":"hashicorp/terraform","slug":"failed-to-create-cert-signer-q-s","errorCode":null,"errorMessage":"failed to create cert signer %q: %s","messagePattern":"failed to create cert signer %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/provisioner.go","lineNumber":415,"sourceCode":"func signCertWithPrivateKey(pk string, certificate string) (ssh.AuthMethod, error) {\n\trawPk, err := ssh.ParseRawPrivateKey([]byte(pk))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse private key %q: %s\", pk, err)\n\t}\n\n\tpcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certificate))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate %q: %s\", certificate, err)\n\t}\n\n\tusigner, err := ssh.NewSignerFromKey(rawPk)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create signer from raw private key %q: %s\", rawPk, err)\n\t}\n\n\tucertSigner, err := ssh.NewCertSigner(pcert.(*ssh.Certificate), usigner)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create cert signer %q: %s\", usigner, err)\n\t}\n\n\treturn ssh.PublicKeys(ucertSigner), nil\n}\n\nfunc readPrivateKey(pk string) (ssh.AuthMethod, error) {\n\t// We parse the private key on our own first so that we can\n\t// show a nicer error if the private key has a password.\n\tblock, _ := pem.Decode([]byte(pk))\n\tif block == nil {\n\t\treturn nil, errors.New(\"Failed to read ssh private key: no key found\")\n\t}\n\tif block.Headers[\"Proc-Type\"] == \"4,ENCRYPTED\" {\n\t\treturn nil, errors.New(\n\t\t\t\"Failed to read ssh private key: password protected keys are\\n\" +\n\t\t\t\t\"not supported. Please decrypt the key prior to use.\")\n\t}\n","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/provisioner.go#L397-L433","documentation":"Raised in signCertWithPrivateKey when ssh.NewCertSigner fails. Both the private key and certificate parsed successfully and a signer was created, but the certificate could not be bound to the signer. The most common cause is a key/cert type mismatch: the certificate was issued for a different public key than the private key supplied.","triggerScenarios":"ssh.NewCertSigner validates that the certificate's public key matches the signer's public key. If the private_key and certificate belong to different key pairs, or the certificate type is incompatible with the signer type, this fails.","commonSituations":"The private_key and certificate were generated from different key pairs (e.g. cert for id_rsa but private_key set to id_ed25519), the certificate was issued for a different key after regeneration, or a stale certificate is paired with a new key.","solutions":["Ensure the private_key and certificate come from the same key pair (the cert's public key must match the private key's public key).","Regenerate both the key pair and certificate together with ssh-keygen -s ca_key -I identity id_ed25519.pub.","Verify the match: compare ssh-keygen -y -f private_key with the cert's embedded key via ssh-keygen -L -f cert.","Check for stale certificate files from a previous key rotation."],"exampleFix":"// before\nconnection {\n  private_key = file(\"~/.ssh/id_rsa\")      # RSA key\n  certificate = file(\"~/.ssh/ed25519-cert.pub\") # cert for a DIFFERENT key\n}\n\n// after\nconnection {\n  private_key = file(\"~/.ssh/id_ed25519\")\n  certificate = file(\"~/.ssh/id_ed25519-cert.pub\")\n}","handlingStrategy":"validation","validationCode":"// Validate that the private key and certificate belong to the same key pair\nfunc validateKeyCertPair(pk, cert string) error {\n    rawPk, err := ssh.ParseRawPrivateKey([]byte(pk))\n    if err != nil {\n        return fmt.Errorf(\"invalid private key: %w\", err)\n    }\n    signer, err := ssh.NewSignerFromKey(rawPk)\n    if err != nil {\n        return fmt.Errorf(\"cannot create signer: %w\", err)\n    }\n    pcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(cert))\n    if err != nil {\n        return fmt.Errorf(\"invalid certificate: %w\", err)\n    }\n    sshCert, ok := pcert.(*ssh.Certificate)\n    if !ok {\n        return errors.New(\"not a certificate\")\n    }\n    if !bytes.Equal(signer.PublicKey().Marshal(), sshCert.Key.Marshal()) {\n        return errors.New(\"private key and certificate public keys do not match\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always generate the key pair and certificate together from the same base key.","After rotating keys, regenerate certificates — never mix old certs with new keys.","Verify the match with ssh-keygen -y -f private_key vs ssh-keygen -L -f cert before use."],"tags":["ssh","certificate","signer","key-mismatch","authentication","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}