{"record":{"id":"213503b22cfbe5e7","repo":"hashicorp/terraform","slug":"failed-to-create-signer-from-raw-private-key-q","errorCode":null,"errorMessage":"failed to create signer from raw private key %q: %s","messagePattern":"failed to create signer from raw private key %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/provisioner.go","lineNumber":410,"sourceCode":"\n\treturn conf, nil\n}\n\n// Create a Cert Signer and return ssh.AuthMethod\nfunc signCertWithPrivateKey(pk string, certificate string) (ssh.AuthMethod, error) {\n\trawPk, err := ssh.ParseRawPrivateKey([]byte(pk))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse private key %q: %s\", pk, err)\n\t}\n\n\tpcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certificate))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate %q: %s\", certificate, err)\n\t}\n\n\tusigner, err := ssh.NewSignerFromKey(rawPk)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create signer from raw private key %q: %s\", rawPk, err)\n\t}\n\n\tucertSigner, err := ssh.NewCertSigner(pcert.(*ssh.Certificate), usigner)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create cert signer %q: %s\", usigner, err)\n\t}\n\n\treturn ssh.PublicKeys(ucertSigner), nil\n}\n\nfunc readPrivateKey(pk string) (ssh.AuthMethod, error) {\n\t// We parse the private key on our own first so that we can\n\t// show a nicer error if the private key has a password.\n\tblock, _ := pem.Decode([]byte(pk))\n\tif block == nil {\n\t\treturn nil, errors.New(\"Failed to read ssh private key: no key found\")\n\t}\n\tif block.Headers[\"Proc-Type\"] == \"4,ENCRYPTED\" {","sourceCodeStart":392,"sourceCodeEnd":428,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/provisioner.go#L392-L428","documentation":"Raised in signCertWithPrivateKey when ssh.NewSignerFromKey(rawPk) fails. The private key was successfully parsed by ParseRawPrivateKey, but converting the resulting crypto.PrivateKey into an ssh.Signer failed. This typically indicates the parsed key is of an unsupported or degenerate type for signer creation.","triggerScenarios":"ParseRawPrivateKey succeeded (the key is valid PEM) but the resulting key type is not suitable for signing — for example an unsupported curve, a key type the SSH signer does not handle, or a malformed key structure that parses but cannot sign.","commonSituations":"The private key uses an exotic or very new key type not yet supported by the Go x/crypto/ssh version bundled with terraform, or the key file contains a multi-key bundle where ParseRawPrivateKey returned an unexpected type.","solutions":["Regenerate the key pair using a standard supported type: RSA (>=2048), ECDSA (P-256/P-384/P-521), or Ed25519.","Update terraform to a newer version that bundles a newer x/crypto/ssh with broader key support.","Verify the key file contains a single private key, not a bundle.","Test the key with ssh-keygen -y -f keyfile to confirm it produces a valid public key."],"exampleFix":"// before\nconnection {\n  private_key  = file(\"~/.ssh/exotic_key\")\n  certificate  = file(\"~/.ssh/exotic_key-cert.pub\")\n}\n\n// after\nconnection {\n  private_key  = file(\"~/.ssh/id_ed25519\")\n  certificate  = file(\"~/.ssh/id_ed25519-cert.pub\")\n}","handlingStrategy":"validation","validationCode":"// Validate the private key can produce a signer before use\nfunc validateKeyCanSign(pk string) error {\n    rawPk, err := ssh.ParseRawPrivateKey([]byte(pk))\n    if err != nil {\n        return fmt.Errorf(\"cannot parse private key: %w\", err)\n    }\n    if _, err := ssh.NewSignerFromKey(rawPk); err != nil {\n        return fmt.Errorf(\"key type does not support signing: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use standard key types (RSA >=2048, ECDSA, Ed25519) supported by Go's SSH library.","Update terraform to pick up newer x/crypto/ssh for newer key type support.","Verify the key file contains a single private key, not a bundle."],"tags":["ssh","private-key","signer","certificate","key-type","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}