{"record":{"id":"0fb85d4a7f469f54","repo":"ipfs/kubo","slug":"expected-private-key-type-in-pem-block-but-got-s","errorCode":null,"errorMessage":"expected PRIVATE KEY type in PEM block but got: %s","messagePattern":"expected PRIVATE KEY type in PEM block but got: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":495,"sourceCode":"\t\t}\n\t\tdefer file.Close()\n\n\t\tdata, err := io.ReadAll(file)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\timportFormat, _ := req.Options[keyFormatOptionName].(string)\n\t\tvar sk crypto.PrivKey\n\t\tswitch importFormat {\n\t\tcase keyFormatPemCleartextOption:\n\t\t\tpemBlock, rest := pem.Decode(data)\n\t\t\tif pemBlock == nil {\n\t\t\t\treturn fmt.Errorf(\"PEM block not found in input data:\\n%s\", rest)\n\t\t\t}\n\n\t\t\tif pemBlock.Type != \"PRIVATE KEY\" {\n\t\t\t\treturn fmt.Errorf(\"expected PRIVATE KEY type in PEM block but got: %s\", pemBlock.Type)\n\t\t\t}\n\n\t\t\tstdKey, err := parsePKCS8PrivateKey(pemBlock.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing PKCS8 format: %w\", err)\n\t\t\t}\n\n\t\t\t// In case ed25519.PrivateKey is returned we need the pointer for\n\t\t\t// conversion to libp2p (see export command for more details).\n\t\t\tif ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {\n\t\t\t\tstdKey = &ed25519KeyPointer\n\t\t\t}\n\n\t\t\tsk, _, err = crypto.KeyPairFromStdKey(stdKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"converting std Go key to libp2p key: %w\", err)\n\t\t\t}\n\t\tcase keyFormatLibp2pCleartextOption:","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L477-L513","documentation":"`ipfs key import --format=pem-pkcs8-cleartext` requires the PEM file to contain a block of type \"PRIVATE KEY\" (PKCS8). The file decoded as PEM, but its block header was a different type (e.g. \"ENCRYPTED PRIVATE KEY\", \"RSA PRIVATE KEY\", \"PUBLIC KEY\"), so kubo refuses to parse it as an unencrypted PKCS8 key.","triggerScenarios":"Running `ipfs key import name -f pem-pkcs8-cleartext key.pem` where key.pem is PEM but not a PKCS8 \"PRIVATE KEY\" block: an openssl legacy `RSA PRIVATE KEY` (PKCS1) file, an `ENCRYPTED PRIVATE KEY` produced without `-nocrypt`, or a `PUBLIC KEY` file instead of the private one.","commonSituations":"Developer generated a key with `openssl genpkey -algorithm RSA -aes256` (encrypted output), exported from a tool using PKCS1 (`openssl rsa -traditional`), or grabbed the wrong (public) key file.","solutions":["Regenerate the key as unencrypted PKCS8: `openssl genpkey -algorithm ED25519 -out key.pem` or `openssl pkcs8 -topk8 -nocrypt -in old.pem -out key.pem`","Check the PEM header in the file; it must read `-----BEGIN PRIVATE KEY-----`","If the file is a PUBLIC KEY, locate and use the corresponding private key file"],"exampleFix":"// before (PKCS1, not PKCS8)\n$ openssl genrsa -traditional -out key.pem 2048\n-----BEGIN RSA PRIVATE KEY-----\n// after (PKCS8)\n$ openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem\n-----BEGIN PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"data, _ := os.ReadFile(\"key.pem\")\nblock, _ := pem.Decode(data)\nif block == nil || block.Type != \"PRIVATE KEY\" {\n    return fmt.Errorf(\"key.pem must be an unencrypted PKCS8 'PRIVATE KEY' PEM block, got type %q\", func() string { if block != nil { return block.Type }; return \"\" }())\n}","typeGuard":"func isPKCS8Pem(data []byte) bool {\n    b, _ := pem.Decode(data)\n    return b != nil && b.Type == \"PRIVATE KEY\"\n}","tryCatchPattern":null,"preventionTips":["Generate keys with `openssl genpkey -algorithm ED25519` which emits PKCS8 by default","Never use `-aes256`/encryption when exporting for ipfs key import","Check the PEM header line begins with `-----BEGIN PRIVATE KEY-----` before importing"],"tags":["keystore","pem","pkcs8","key-import"],"backgroundTag":"pem-block-type-mismatch","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}