{"record":{"id":"216fe8e4490eb711","repo":"hyperledger/fabric","slug":"failed-to-parse-private-key-v","errorCode":null,"errorMessage":"failed to parse private key: %v","messagePattern":"failed to parse private key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/common/signer/signer.go","lineNumber":143,"sourceCode":"// Based on crypto/tls/tls.go but modified for Fabric:\nfunc parsePrivateKey(der []byte) (crypto.PrivateKey, error) {\n\t// OpenSSL 1.0.0 generates PKCS#8 keys.\n\tif key, err := x509.ParsePKCS8PrivateKey(der); err == nil {\n\t\tswitch key := key.(type) {\n\t\t// Fabric only supports ECDSA at the moment.\n\t\tcase *ecdsa.PrivateKey:\n\t\t\treturn key, nil\n\t\tcase ed25519.PrivateKey:\n\t\t\treturn key, nil\n\t\tdefault:\n\t\t\treturn nil, errors.Errorf(\"found unknown private key type (%T) in PKCS#8 wrapping\", key)\n\t\t}\n\t}\n\n\t// OpenSSL ecparam generates SEC1 EC private keys for ECDSA.\n\tkey, err := x509.ParseECPrivateKey(der)\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed to parse private key: %v\", err)\n\t}\n\n\treturn key, nil\n}\n\nfunc signECDSA(k *ecdsa.PrivateKey, digest []byte) (signature []byte, err error) {\n\tr, s, err := ecdsa.Sign(rand.Reader, k, digest)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ts, err = utils.ToLowS(&k.PublicKey, s)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn marshalECDSASignature(r, s)\n}","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/cmd/common/signer/signer.go#L125-L161","documentation":"If the DER bytes are not PKCS#8 (or fail to parse), parsePrivateKey falls back to x509.ParseECPrivateKey to handle SEC1 EC keys generated by 'openssl ecparam'. When that also fails, this error wraps the underlying parse failure, meaning the key is neither valid PKCS#8 nor a SEC1 EC private key.","triggerScenarios":"Key file contains an encrypted PEM block (passphrase-protected, pem.Decode yields the block but DER is encrypted), an RSA/PKCS#1 key that failed PKCS#8 parse, corrupted DER, or a public key instead of a private key.","commonSituations":"Passphrase-protected key with no decryption step; PKCS#1 RSA key ('BEGIN RSA PRIVATE KEY') rejected by both parsers; truncated or edited key file; copied key missing lines.","solutions":["Decrypt the key first: openssl pkey -in key.pem -passin pass:... -out key_nocrypt.pem","Convert to supported format: openssl ecparam/openssl pkey to produce an unencrypted EC PEM key","Check the PEM header — 'ENCRYPTED PRIVATE KEY' or 'RSA PRIVATE KEY' indicates the unsupported case","Re-export the key from the MSP/cert-authority source and confirm with openssl pkey -noout -text"],"exampleFix":"// before: encrypted key\n-----BEGIN ENCRYPTED PRIVATE KEY-----\n// after\nopenssl pkcs8 -topk8 -nocrypt -in key.pem -out key_nocrypt.pem\n# or: openssl pkey -in enc.pem -passin pass:secret -out key.pem","handlingStrategy":"validation","validationCode":"b, _ := os.ReadFile(keyPath)\nblk, _ := pem.Decode(b)\nif strings.Contains(blk.Headers[\"Proc-Type\"], \"ENCRYPTED\") || blk.Type == \"ENCRYPTED PRIVATE KEY\" {\n    return fmt.Errorf(\"%s is encrypted; decrypt before use\", keyPath)\n}\nif _, err := x509.ParseECPrivateKey(blk.Bytes); err != nil {\n    if _, err8 := x509.ParsePKCS8PrivateKey(blk.Bytes); err8 != nil {\n        return fmt.Errorf(\"%s is neither PKCS#8 nor SEC1 EC key\", keyPath)\n    }\n}","typeGuard":null,"tryCatchPattern":"s, err := signer.NewSigner(keyPath, idPath)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to parse private key\") {\n        return fmt.Errorf(\"key %s unparseable; decrypt/convert with openssl pkey\", keyPath)\n    }\n    return err\n}","preventionTips":["Never deploy passphrase-protected keys without decrypting them","Convert all keys to unencrypted PKCS#8 ECDSA PEM in provisioning scripts","Verify with openssl pkey -in key.pem -noout before use"],"tags":["crypto","private-key","pkcs8","fabric"],"backgroundTag":"private-key-parse-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}