{"record":{"id":"0b8acfd04972ff25","repo":"apache/cassandra","slug":"failed-to-decrypt-the-private-key-data-either-the","errorCode":null,"errorMessage":"Failed to decrypt the private key data. Either the password provided for the key is wrong or the private key data is corrupted. msg=","messagePattern":"Failed to decrypt the private key data\\. Either the password provided for the key is wrong or the private key data is corrupted\\. msg=","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMReader.java","lineNumber":129,"sourceCode":"            EncryptedPrivateKeyInfo epki = new EncryptedPrivateKeyInfo(derKeyBytes);\n            logger.debug(\"Encrypted private key info's algorithm name: {}\", epki.getAlgName());\n\n            AlgorithmParameters params = epki.getAlgParameters();\n            PBEKeySpec pbeKeySpec = new PBEKeySpec(keyPassword.toCharArray());\n            Key encryptionKey = SecretKeyFactory.getInstance(epki.getAlgName()).generateSecret(pbeKeySpec);\n            pbeKeySpec.clearPassword();\n            logger.debug(\"Key algorithm: {}, key format: {}\", encryptionKey.getAlgorithm(), encryptionKey.getFormat());\n\n            Cipher cipher = Cipher.getInstance(epki.getAlgName());\n            cipher.init(Cipher.DECRYPT_MODE, encryptionKey, params);\n            byte[] rawKeyBytes;\n            try\n            {\n                rawKeyBytes = cipher.doFinal(epki.getEncryptedData());\n            }\n            catch (BadPaddingException e)\n            {\n                throw new GeneralSecurityException(\"Failed to decrypt the private key data. Either the password \" +\n                                                   \"provided for the key is wrong or the private key data is \" +\n                                                   \"corrupted. msg=\" + e.getMessage(), e);\n            }\n            logger.debug(\"Decrypted private key's length: {}\", rawKeyBytes.length);\n\n            keySpec = new PKCS8EncodedKeySpec(rawKeyBytes);\n        }\n        else\n        {\n            logger.debug(\"Key length: {}\", derKeyBytes.length);\n            keySpec = new PKCS8EncodedKeySpec(derKeyBytes);\n        }\n\n        PrivateKey privateKey = null;\n\n        /*\n         * Ideally we can inspect the OID (Object Identifier) from the private key with ASN.1 parser and identify the\n         * actual algorithm of the private key. For doing that, we have to use some special library like BouncyCastle.","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMReader.java#L111-L147","documentation":"Thrown by PEMReader.extractPrivateKey when PKCS8 EncryptedPrivateKeyInfo decryption fails while parsing a PEM private key. This is a generic guard: the supplied keyPassword did not decrypt the key, or the DER-encoded key bytes are corrupt/truncated. It wraps the underlying GeneralSecurityException (typically BadPaddingException from the PBE cipher).","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMReader.java:129 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the key_password configured for the SSL factory matches the passphrase the key was encrypted with","Re-export the PEM key and confirm it is valid PKCS#8 (e.g. with openssl pkey -in key.pem -text)","If the key is unencrypted, ensure the PEM block type matches what the parser expects (BEGIN PRIVATE KEY vs BEGIN ENCRYPTED PRIVATE KEY)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}