{"record":{"id":"0cc3c074dfdcc66a","repo":"react/create-react-app","slug":"the-certificate-key-keyfile-is-invalid-n-er","errorCode":null,"errorMessage":"The certificate key \"${keyFile}\" is invalid.\\n${err.message}","messagePattern":"The certificate key \"(.+?)\" is invalid\\.\\\\n(.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-scripts/config/getHttpsConfig.js","lineNumber":34,"sourceCode":"\n// Ensure the certificate and key provided are valid and if not\n// throw an easy to debug error\nfunction validateKeyAndCerts({ cert, key, keyFile, crtFile }) {\n  let encrypted;\n  try {\n    // publicEncrypt will throw an error with an invalid cert\n    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));\n  } catch (err) {\n    throw new Error(\n      `The certificate \"${chalk.yellow(crtFile)}\" is invalid.\\n${err.message}`\n    );\n  }\n\n  try {\n    // privateDecrypt will throw an error with an invalid key\n    crypto.privateDecrypt(key, encrypted);\n  } catch (err) {\n    throw new Error(\n      `The certificate key \"${chalk.yellow(keyFile)}\" is invalid.\\n${\n        err.message\n      }`\n    );\n  }\n}\n\n// Read file and throw an error if it doesn't exist\nfunction readEnvFile(file, type) {\n  if (!fs.existsSync(file)) {\n    throw new Error(\n      `You specified ${chalk.cyan(\n        type\n      )} in your env, but the file \"${chalk.yellow(file)}\" can't be found.`\n    );\n  }\n  return fs.readFileSync(file);\n}","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/config/getHttpsConfig.js#L16-L52","documentation":"After validating the certificate, getHttpsConfig.validateKeyAndCerts attempts to decrypt the test buffer with crypto.privateDecrypt using the supplied key. If that throws, the key is invalid or does not match the certificate, and the error is re-thrown naming keyFile and the underlying message.","triggerScenarios":"SSL_KEY_FILE is set to a file that is not a valid private key, or is a valid key that does not correspond to the certificate in SSL_CRT_FILE. crypto.privateDecrypt throws and the catch re-wraps the error.","commonSituations":"Regenerating the cert but forgetting to regenerate/swap the key. Using an encrypted (passphrase-protected) key that Node cannot read unattended. Key/cert from different pairs. Truncated or mis-formatted PEM key.","solutions":["Ensure SSL_KEY_FILE is the unencrypted PEM private key matching SSL_CRT_FILE (same keypair).","If the key is passphrase-protected, decrypt it: `openssl rsa -in enc.key -out key.pem`, or regenerate without a passphrase.","Verify the PEM key footer/header (`-----BEGIN PRIVATE KEY-----` / `-----END PRIVATE KEY-----`).","Regenerate both cert and key together so they stay a matched pair."],"exampleFix":"# before\nSSL_CRT_FILE=./cert.pem\nSSL_KEY_FILE=./encrypted.key   # passphrase-protected\n# after\nSSL_CRT_FILE=./cert.pem\nSSL_KEY_FILE=./key.pem         # unencrypted, matching private key","handlingStrategy":"validation","validationCode":"const fs = require('fs');\nconst crypto = require('crypto');\nfunction validateKeyFile(certFile, keyFile) {\n  const cert = fs.readFileSync(certFile);\n  const key = fs.readFileSync(keyFile);\n  const enc = crypto.publicEncrypt(cert, Buffer.from('test'));\n  try { crypto.privateDecrypt(key, enc); }\n  catch (e) { throw new Error(`SSL_KEY_FILE invalid or mismatched: ${e.message}`); }\n}\nif (process.env.SSL_CRT_FILE && process.env.SSL_KEY_FILE) {\n  validateKeyFile(process.env.SSL_CRT_FILE, process.env.SSL_KEY_FILE);\n}","typeGuard":"const looksLikePemKey = (contents) =>\n  /-----BEGIN (?:RSA )?PRIVATE KEY-----/.test(contents);","tryCatchPattern":"try {\n  require('react-scripts/config/getHttpsConfig');\n} catch (e) {\n  if (/certificate key .* is invalid/i.test(e.message)) {\n    console.error('SSL_KEY_FILE invalid or does not match SSL_CRT_FILE.');\n    process.exit(1);\n  }\n  throw e;\n}","preventionTips":["Always generate cert and key as a matched pair (openssl req -x509 -newkey ...).","Decrypt passphrase-protected keys before pointing Node at them.","Verify the key with `openssl rsa -in key.pem -check -noout`.","Never mix keys/certs from different generations."],"tags":["https","ssl","certificate","crypto","config","key"],"backgroundTag":null,"analyzedSha":"6254386531d263688ccfa542d0e628fbc0de0b28","analyzedAt":"2026-08-12T22:55:01.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}