{"record":{"id":"1c5e797b614726c8","repo":"ducaale/xh","slug":"message-signature-failed-to-parse-pem-private-key-supported","errorCode":null,"errorMessage":"message-signature: Failed to parse PEM private key. Supported algorithms: ed25519, ecdsa-p256-sha256, ecdsa-p384-sha384, rsa-v1_5-sha256, rsa-pss-sha512","messagePattern":"message-signature: Failed to parse PEM private key\\. Supported algorithms: ed25519, ecdsa-p256-sha256, ecdsa-p384-sha384, rsa-v1_5-sha256, rsa-pss-sha512","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/message_signature.rs","lineNumber":275,"sourceCode":"                    AlgorithmName::Ed25519,\n                    AlgorithmName::EcdsaP256Sha256,\n                    AlgorithmName::EcdsaP384Sha384,\n                ],\n            ) {\n                let alg = secret.alg();\n                return Ok((MessageSigningKey::Secret(secret, key_id.to_string()), alg));\n            }\n            if parse_pem_secret_key(\n                pem,\n                &[AlgorithmName::RsaV1_5Sha256, AlgorithmName::RsaPssSha512],\n            )\n            .is_some()\n            {\n                bail!(\n                    \"message-signature: RSA private keys require an explicit algorithm. Use --unstable-m-sig-alg=rsa-v1_5-sha256 or --unstable-m-sig-alg=rsa-pss-sha512\"\n                );\n            }\n            bail!(\n                \"message-signature: Failed to parse PEM private key. Supported algorithms: ed25519, ecdsa-p256-sha256, ecdsa-p384-sha384, rsa-v1_5-sha256, rsa-pss-sha512\"\n            );\n        }\n    }\n\n    build_hmac_signing_key(key_material, key_id)\n}\n\nfn build_hmac_signing_key(\n    key_material: &[u8],\n    key_id: &str,\n) -> Result<(MessageSigningKey, AlgorithmName)> {\n    let encoded = STANDARD.encode(key_material);\n    let shared_key = SharedKey::from_base64(&AlgorithmName::HmacSha256, &encoded)\n        .map_err(|e| anyhow!(\"message-signature: Failed to create HMAC key: {:?}\", e))?;\n    Ok((\n        MessageSigningKey::Shared(shared_key, key_id.to_string()),\n        AlgorithmName::HmacSha256,","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/ducaale/xh/blob/2404aceecc08b0b2d100fedc96f57745cd5904dc/src/message_signature.rs#L257-L293","documentation":"build_signing_key failed to parse the supplied PEM private key with any supported algorithm's parser. After ruling out RSA keys needing explicit algorithm selection, it bails listing the supported algorithms: ed25519, ecdsa-p256-sha256, ecdsa-p384-sha384, rsa-v1_5-sha256, rsa-pss-sha512.","triggerScenarios":"sign_request called with key material that is neither a parseable ed25519/ECDSA/RSA PEM nor valid HMAC secret, e.g. malformed PEM, encrypted PEM, a public key instead of a private key, or an unsupported key type.","commonSituations":"Wrong file passed as key (certificate or public key); PEM encrypted with a passphrase; truncated/corrupted PEM; unsupported curve or key format (PKCS#8 variants not handled).","solutions":["Verify the file is an unencrypted PEM private key (check BEGIN PRIVATE KEY header)","Use a supported key type: ed25519, ECDSA P-256/P-384, or RSA (with explicit --unstable-m-sig-alg)","Re-export the key without a passphrase and in PKCS#8 PEM format","If intending HMAC, pass the raw secret without PEM markers"],"exampleFix":"# before (public key passed)\nhttp --message-signature key=pubkey.pem ...\n# after (private key, supported format)\nhttp --message-signature key=ed25519_private.pem ...","handlingStrategy":"validation","validationCode":"// pre-check the PEM before signing\nfn pem_looks_valid(key: &str) -> bool {\n    key.contains(\"-----BEGIN\") && key.contains(\"PRIVATE KEY-----\") && !key.contains(\"ENCRYPTED\")\n}\nassert!(pem_looks_valid(&std::fs::read_to_string(\"key.pem\")?));","typeGuard":"fn is_supported_private_pem(pem: &str) -> bool {\n    pem.contains(\"PRIVATE KEY-----\") && !pem.contains(\"ENCRYPTED\") && !pem.contains(\"PUBLIC KEY\")\n}","tryCatchPattern":"match sign_request(&req, &components, &key) {\n    Ok(s) => s,\n    Err(e) if e.to_string().contains(\"Failed to parse PEM private key\") => {\n        eprintln!(\"check key format; supported: ed25519, ecdsa-p256-sha256, ecdsa-p384-sha384, rsa-v1_5-sha256, rsa-pss-sha512\");\n        return Err(e);\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Verify the PEM header says PRIVATE KEY, not PUBLIC KEY or CERTIFICATE","Decrypt passphrase-protected keys before use","Use PKCS#8 PEM output when exporting keys (openssl pkey -traditional-free / -outform PEM)","Test key loading in CI with a known-good key"],"tags":["signature","pem","crypto","key-format"],"backgroundTag":"invalid-argument-format","analyzedSha":"2404aceecc08b0b2d100fedc96f57745cd5904dc","analyzedAt":"2026-09-13T19:13:33.814Z","contentChangedAt":"2026-09-13T19:13:33.814Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}