{"record":{"id":"1b56012fc9c05311","repo":"spring-projects/spring-security","slug":"is-not-a-supported-format","errorCode":null,"errorMessage":" is not a supported format","messagePattern":" is not a supported format","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java","lineNumber":120,"sourceCode":"\t\t\t\t\tRSAPublicKeySpec pubSpec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());\n\t\t\t\t\tRSAPrivateCrtKeySpec privSpec = new RSAPrivateCrtKeySpec(key.getModulus(), key.getPublicExponent(),\n\t\t\t\t\t\t\tkey.getPrivateExponent(), key.getPrime1(), key.getPrime2(), key.getExponent1(),\n\t\t\t\t\t\t\tkey.getExponent2(), key.getCoefficient());\n\t\t\t\t\tpublicKey = fact.generatePublic(pubSpec);\n\t\t\t\t\tprivateKey = fact.generatePrivate(privSpec);\n\t\t\t\t}\n\t\t\t\tcase \"PUBLIC KEY\" -> {\n\t\t\t\t\tKeySpec keySpec = new X509EncodedKeySpec(content);\n\t\t\t\t\tpublicKey = fact.generatePublic(keySpec);\n\t\t\t\t}\n\t\t\t\tcase \"RSA PUBLIC KEY\" -> {\n\t\t\t\t\tASN1Sequence seq = ASN1Sequence.getInstance(content);\n\t\t\t\t\torg.bouncycastle.asn1.pkcs.RSAPublicKey key = org.bouncycastle.asn1.pkcs.RSAPublicKey\n\t\t\t\t\t\t.getInstance(seq);\n\t\t\t\t\tRSAPublicKeySpec pubSpec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());\n\t\t\t\t\tpublicKey = fact.generatePublic(pubSpec);\n\t\t\t\t}\n\t\t\t\tdefault -> throw new IllegalArgumentException(type + \" is not a supported format\");\n\t\t\t}\n\n\t\t\treturn new KeyPair(publicKey, privateKey);\n\t\t}\n\t\tcatch (InvalidKeySpecException ex) {\n\t\t\tthrow new RuntimeException(ex);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalStateException(ex);\n\t\t}\n\t}\n\n\tprivate static byte[] base64Decode(String string) {\n\t\ttry {\n\t\t\tByteBuffer bytes = UTF8.newEncoder().encode(CharBuffer.wrap(string));\n\t\t\tbyte[] bytesCopy = new byte[bytes.limit()];\n\t\t\tSystem.arraycopy(bytes.array(), 0, bytesCopy, 0, bytes.limit());\n\t\t\treturn Base64.getDecoder().decode(bytesCopy);","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java#L102-L138","documentation":"parseKeyPair() switches on the PEM header type; any type other than the supported ones (RSA PRIVATE KEY, PUBLIC KEY, etc.) falls into the default branch and throws this IllegalArgumentException with the unsupported type name prepended. It means the key file declares a PEM block type this helper cannot parse.","triggerScenarios":"Input PEM begins with e.g. -----BEGIN ENCRYPTED PRIVATE KEY-----, -----BEGIN EC PRIVATE KEY-----, -----BEGIN CERTIFICATE-----, or a new OpenSSH 'OPENSSH PRIVATE KEY' header, which is not among the handled switch cases.","commonSituations":"Using elliptic-curve keys instead of RSA; using password-protected (encrypted) PEMs; OpenSSH's default private key format (ssh-keygen without -m PEM); passing a certificate chain file instead of a key.","solutions":["Convert the key to an unencrypted RSA PEM: openssl rsa -in key.pem -out unencrypted.pem","Regenerate with PEM RSA format: ssh-keygen -m PEM -t rsa -b 2048","Use an RSA key rather than EC/DSA, or a different helper supporting that type","Extract the key from the certificate if a cert was passed by mistake"],"exampleFix":"// before\n-----BEGIN OPENSSH PRIVATE KEY----- ... // unsupported\n// after\nssh-keygen -p -m PEM -f id_rsa   // yields -----BEGIN RSA PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"java.util.regex.Matcher m = java.util.regex.Pattern\n    .compile(\"-----BEGIN (RSA PRIVATE KEY|PUBLIC KEY|RSA PUBLIC KEY)-----\")\n    .matcher(pem);\nif (!m.find()) throw new IllegalArgumentException(\"Unsupported PEM type: use RSA PRIVATE KEY or PUBLIC KEY\");","typeGuard":"static boolean supportedPemType(String pem) {\n    return pem != null && pem.matches(\"(?s).*-----BEGIN (RSA PRIVATE KEY|PUBLIC KEY|RSA PUBLIC KEY)-----.*\");\n}","tryCatchPattern":"try { return RsaKeyHelper.parseKeyPair(pem); } catch (IllegalArgumentException ex) { throw new UnsupportedKeyFormatException(pem == null ? null : pem.substring(0, Math.min(40, pem.length())), ex); }","preventionTips":["Use RSA keys, not EC/DSA, with this helper","Decrypt or strip passphrase protection before parsing (no ENCRYPTED PRIVATE KEY)","Convert OpenSSH format: ssh-keygen -p -m PEM","Pass keys, not certificates"],"tags":["pem","rsa","unsupported-format","invalid-input"],"backgroundTag":"unsupported-key-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}