{"record":{"id":"19a424e1f425cb26","repo":"ipfs/kubo","slug":"unexpected-pem-block-for-format-s-try-again-with","errorCode":null,"errorMessage":"unexpected PEM block for format=%s: try again with format=%s","messagePattern":"unexpected PEM block for format=(.+?): try again with format=(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":519,"sourceCode":"\t\t\t}\n\n\t\t\t// In case ed25519.PrivateKey is returned we need the pointer for\n\t\t\t// conversion to libp2p (see export command for more details).\n\t\t\tif ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {\n\t\t\t\tstdKey = &ed25519KeyPointer\n\t\t\t}\n\n\t\t\tsk, _, err = crypto.KeyPairFromStdKey(stdKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"converting std Go key to libp2p key: %w\", err)\n\t\t\t}\n\t\tcase keyFormatLibp2pCleartextOption:\n\t\t\tsk, err = crypto.UnmarshalPrivateKey(data)\n\t\t\tif err != nil {\n\t\t\t\t// check if data is PEM, if so, provide user with hint\n\t\t\t\tpemBlock, _ := pem.Decode(data)\n\t\t\t\tif pemBlock != nil {\n\t\t\t\t\treturn fmt.Errorf(\"unexpected PEM block for format=%s: try again with format=%s\", keyFormatLibp2pCleartextOption, keyFormatPemCleartextOption)\n\t\t\t\t}\n\t\t\t\treturn fmt.Errorf(\"unable to unmarshall format=%s: %w\", keyFormatLibp2pCleartextOption, err)\n\t\t\t}\n\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unrecognized import format: %s\", importFormat)\n\t\t}\n\n\t\t// We only allow importing keys of the same type we generate (see list in\n\t\t// https://github.com/ipfs/interface-go-ipfs-core/blob/1c3d8fc/options/key.go#L58-L60),\n\t\t// unless explicitly stated by the user.\n\t\tallowAnyKeyType, _ := req.Options[keyAllowAnyTypeOptionName].(bool)\n\t\tif !allowAnyKeyType {\n\t\t\tswitch t := sk.(type) {\n\t\t\tcase *crypto.RsaPrivateKey, *crypto.Ed25519PrivateKey, *crypto.Secp256k1PrivateKey:\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1;\"+\n\t\t\t\t\t\" use flag --%s if you are sure of what you're doing\",","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L501-L537","documentation":"`ipfs key import` was run with the default format `libp2p-protobuf-cleartext`, but the input data decoded as a PEM block, which that binary protobuf format never is. Kubo detects the mismatch and tells you to retry with `--format=pem-pkcs8-cleartext`.","triggerScenarios":"`ipfs key import name key.pem` (without `-f`) on a PEM/PKCS8 file, e.g. one produced by `ipfs key export -f pem-pkcs8-cleartext` or openssl.","commonSituations":"Following the openssl-to-ipfs workflow from the docs but forgetting the `-f pem-pkcs8-cleartext` flag; scripts importing keys exported in PEM format from another node.","solutions":["Re-run with the PEM format flag: `ipfs key import name -f pem-pkcs8-cleartext key.pem`","If the key truly is libp2p protobuf format, strip any accidental PEM wrapper from the file"],"exampleFix":"// before\n$ ipfs key import mykey key.pem  # default format is libp2p-protobuf-cleartext\nError: unexpected PEM block for format=libp2p-protobuf-cleartext: try again with format=pem-pkcs8-cleartext\n// after\n$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem","handlingStrategy":"validation","validationCode":"data, _ := os.ReadFile(keyFile)\nif _, err := pem.Decode(data); err != nil {\n    format = \"libp2p-protobuf-cleartext\"\n} else {\n    format = \"pem-pkcs8-cleartext\"\n}\n// pass --format=<format> to ipfs key import","typeGuard":"func looksLikePem(data []byte) bool {\n    b, _ := pem.Decode(data)\n    return b != nil\n}","tryCatchPattern":null,"preventionTips":["Always pass an explicit `--format` flag in scripts instead of relying on the default","Remember the default import format is libp2p-protobuf-cleartext, not PEM","Match the format used at export time"],"tags":["keystore","format-mismatch","pem","key-import"],"backgroundTag":"key-format-mismatch","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}