{"record":{"id":"2070e692dc260aad","repo":"hashicorp/packer","slug":"unsupported-private-key-in-signer-q","errorCode":null,"errorMessage":"unsupported private key in signer %q","messagePattern":"unsupported private key in signer %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_key.go","lineNumber":157,"sourceCode":"\n\tblock, _ := pem.Decode(contents)\n\tif block == nil {\n\t\treturn nil, nil, fmt.Errorf(\"decode signer %q: no PEM block found\", path)\n\t}\n\n\tvar signer crypto.Signer\n\tif key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {\n\t\tvar ok bool\n\t\tsigner, ok = key.(crypto.Signer)\n\t\tif !ok {\n\t\t\treturn nil, nil, fmt.Errorf(\"signer %q does not implement crypto.Signer\", path)\n\t\t}\n\t} else if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {\n\t\tsigner = key\n\t} else if key, err := x509.ParseECPrivateKey(block.Bytes); err == nil {\n\t\tsigner = key\n\t} else {\n\t\treturn nil, nil, fmt.Errorf(\"unsupported private key in signer %q\", path)\n\t}\n\n\tpublicKeyPEM, err := marshalPublicKeyPEM(signer.Public())\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tverifier, err := LoadPEMVerifierBytes(publicKeyPEM)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\treturn signer, verifier, nil\n}\n\nfunc loadPEMPublicKey(contents []byte) (crypto.PublicKey, []byte, error) {\n\tblock, _ := pem.Decode(contents)\n\tif block == nil {","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_key.go#L139-L175","documentation":"loadPEMSigner could not parse the PEM block bytes with any supported private-key format: x509.ParsePKCS8PrivateKey, ParsePKCS1PrivateKey, and ParseECPrivateKey all failed. The file contains a PEM block, but its DER payload is not a private key this library understands (or it is corrupted).","triggerScenarios":"Calling newPEMSigner(path) where the PEM block is a PUBLIC KEY, CERTIFICATE, CSR, ENCRYPTED PRIVATE KEY (legacy encrypted PEM), or otherwise not an unencrypted PKCS#1/PKCS#8/EC private key.","commonSituations":"Pointing the signer at the public verifier file by mistake; using an 'ENCRYPTED PRIVATE KEY' PKCS#8 blob that requires decryption first; a PEM block of an unrecognized type (e.g. NEW CERTIFICATE REQUEST); a truncated/corrupted DER body.","solutions":["Make sure the file is the PRIVATE key (header '-----BEGIN PRIVATE KEY-----', 'RSA PRIVATE KEY', or 'EC PRIVATE KEY'), not the public key or certificate.","Decrypt encrypted PKCS#8 first: 'openssl pkcs8 -in encrypted.pem -out decrypted.pem' (supply the passphrase).","Validate with 'openssl pkey -in key.pem -noout' to confirm OpenSSL can parse it, then re-export unencrypted.","If the DER is corrupted, regenerate or re-transfer the key file."],"exampleFix":"// before\nsigner, _, err := attestation.NewSigner(\"verifier-public.pem\") // BEGIN PUBLIC KEY -> unsupported private key\n// after\nsigner, _, err := attestation.NewSigner(\"signing-key.pem\") // BEGIN PRIVATE KEY","handlingStrategy":"validation","validationCode":"raw, _ := os.ReadFile(keyPath)\nblock, _ := pem.Decode(raw)\nif block == nil {\n\treturn fmt.Errorf(\"%s: no PEM block\", keyPath)\n}\nswitch block.Type {\ncase \"PRIVATE KEY\", \"RSA PRIVATE KEY\", \"EC PRIVATE KEY\":\n\t// supported unencrypted private-key types\ndefault:\n\treturn fmt.Errorf(\"%s: PEM type %q is not an unencrypted private key (got public key/cert/CSR/encrypted key?)\", keyPath, block.Type)\n}","typeGuard":"func isPrivate_KeyPEM(b []byte) bool {\n\tblock, _ := pem.Decode(b)\n\tif block == nil {\n\t\treturn false\n\t}\n\tswitch block.Type {\n\tcase \"PRIVATE KEY\", \"RSA PRIVATE KEY\", \"EC PRIVATE KEY\":\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":"signer, verifier, err := attestation.NewSigner(keyPath)\nif err != nil && strings.Contains(err.Error(), \"unsupported private key\") {\n\treturn fmt.Errorf(\"%s is not a PKCS#1/PKCS#8/EC private key; re-export with: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pem.new\", keyPath)\n}","preventionTips":["Double-check you pass the PRIVATE key file to the signer, not the public verifier or certificate.","Decrypt encrypted PKCS#8 ('ENCRYPTED PRIVATE KEY') before use: openssl pkcs8 -in enc.pem -out plain.pem.","Validate keys with 'openssl pkey -in key.pem -noout' during deployment.","Name files explicitly (signing-key.pem vs verifier-public.pem) to prevent mixups."],"tags":["go","crypto","pem","key-format"],"backgroundTag":"unsupported-key-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}