{"record":{"id":"23a5699f9fb7d7d1","repo":"eclipse-vertx/vert.x","slug":"missing-begin-private-key-or-begin","errorCode":null,"errorMessage":"Missing -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- or -----BEGIN EC PRIVATE KEY----- delimiter","messagePattern":"Missing -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- or -----BEGIN EC PRIVATE KEY----- delimiter","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java","lineNumber":322,"sourceCode":"          case \"PRIVATE KEY\":\n            // in PKCS#8 the key algorithm is indicated at the beginning of the ASN.1 structure\n            // so we can use the corresponding key factory once we know the algorithm name\n            String algorithm = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(content);\n            if (rsaKeyFactory.getAlgorithm().equals(algorithm)) {\n              return Collections.singletonList(rsaKeyFactory.generatePrivate(new PKCS8EncodedKeySpec(content)));\n            } else if (ecKeyFactory != null && ecKeyFactory.getAlgorithm().equals(algorithm)) {\n              return Collections.singletonList(ecKeyFactory.generatePrivate(new PKCS8EncodedKeySpec(content)));\n            }\n            // fall through if ECC is not supported by JVM\n          default:\n            return Collections.emptyList();\n        }\n      } catch (InvalidKeySpecException e) {\n        throw new VertxException(e);\n      }\n    });\n    if (pems.isEmpty()) {\n      throw new RuntimeException(\"Missing -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- or -----BEGIN EC PRIVATE KEY----- delimiter\");\n    }\n    return pems.get(0);\n  }\n\n  private static KeyFactory getECKeyFactory() {\n    try {\n      return KeyFactory.getInstance(\"EC\");\n    } catch (NoSuchAlgorithmException e) {\n      // support for ECC is not mandatory in JVM\n      return null;\n    }\n  }\n\n  public static KeyStore loadCA(Stream<Buffer> certValues) throws Exception {\n    final KeyStore keyStore = createEmptyKeyStore();\n    keyStore.load(null, null);\n    int count = 0;\n    Iterable<Buffer> iterable = certValues::iterator;","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java#L304-L340","documentation":"Same site family as the empty-message variant: loadPrivateKey() found no PEM private key block in the provided buffer and throws because the parsed key list is empty. It explicitly names the three delimiters it supports: BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY, BEGIN EC PRIVATE KEY.","triggerScenarios":"keyCertOptions.setKeyPath/setKeyValue receiving a PEM buffer whose only blocks are certificates, or whose key block type is unsupported (e.g. ENCRYPTED PRIVATE KEY), or a truncated file with BEGIN but no key data.","commonSituations":"Swapping cert and key paths; using an encrypted PKCS#8 key with a password the parser cannot supply; concatenating only the CA chain into the key option.","solutions":["Confirm the file contains -----BEGIN PRIVATE KEY----- (PKCS#8), -----BEGIN RSA PRIVATE KEY-----, or -----BEGIN EC PRIVATE KEY-----.","Convert PKCS#1 to PKCS#8 with: openssl pkcs8 -topk8 -nocrypt -in rsakey.pem -out pkcs8key.pem.","Decrypt encrypted keys first (remove ENCRYPTED PRIVATE KEY / Proc-Type headers) or load them via a JKS/PKCS12 keystore instead.","Ensure the key path/Buffer is correct and not the certificate file."],"exampleFix":"// before\noptions.setKeyPath(\"chain-ca.pem\"); // no key block\n// after\noptions.setKeyPath(\"server.key\"); // -----BEGIN PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"String pem = Files.readString(Path.of(keyPath));\nboolean ok = pem.lines().anyMatch(l -> l.startsWith(\"-----BEGIN\") && l.contains(\"PRIVATE KEY\"));\nif (!ok) throw new IllegalStateException(keyPath + \" has no private key PEM block\");","typeGuard":"boolean hasPrivateKeyBlock(String s) {\n  return s != null && s.contains(\"-----BEGIN PRIVATE KEY-----\") ||\n         s != null && s.contains(\"-----BEGIN RSA PRIVATE KEY-----\") ||\n         s != null && s.contains(\"-----BEGIN EC PRIVATE KEY-----\");\n}","tryCatchPattern":null,"preventionTips":["Convert all keys to unencrypted PKCS#8 format once, at provisioning time","Never pass certificate chains or CA bundles as the key option","Log/verify the first line of the key file at startup in dev mode","Document key format requirements in your deployment config schema"],"tags":["ssl","pem","private-key","keystore"],"backgroundTag":"invalid-pem-file","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}