{"record":{"id":"2a7ee7cce8910b7d","repo":"karatelabs/karate","slug":"failed-to-load-private-key-unsupported-algorithm-sslutils","errorCode":null,"errorMessage":"failed to load private key: unsupported algorithm","messagePattern":"failed to load private key: unsupported algorithm","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/core/SslUtils.java","lineNumber":149,"sourceCode":"        // Remove PEM headers/footers and decode\n        String privateKeyPEM = keyString\n                .replace(\"-----BEGIN PRIVATE KEY-----\", \"\")\n                .replace(\"-----END PRIVATE KEY-----\", \"\")\n                .replace(\"-----BEGIN RSA PRIVATE KEY-----\", \"\")\n                .replace(\"-----END RSA PRIVATE KEY-----\", \"\")\n                .replaceAll(\"\\\\s\", \"\");\n\n        byte[] decoded = java.util.Base64.getDecoder().decode(privateKeyPEM);\n        java.security.spec.PKCS8EncodedKeySpec keySpec = new java.security.spec.PKCS8EncodedKeySpec(decoded);\n\n        // Try RSA first, then EC\n        try {\n            return java.security.KeyFactory.getInstance(\"RSA\").generatePrivate(keySpec);\n        } catch (Exception e) {\n            try {\n                return java.security.KeyFactory.getInstance(\"EC\").generatePrivate(keySpec);\n            } catch (Exception e2) {\n                throw new RuntimeException(\"failed to load private key: unsupported algorithm\", e2);\n            }\n        }\n    }\n\n}\n","sourceCodeStart":131,"sourceCodeEnd":155,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/core/SslUtils.java#L131-L155","documentation":"Karate's private-key loader only tries RSA and then EC KeyFactory instances; if the key file is neither an RSA nor an EC private key (e.g. Ed25519, DSA, or a non-PKCS#8 encoding), both attempts fail and this RuntimeException is thrown with the fixed message 'unsupported algorithm'.","triggerScenarios":"Calling privateKey(...) / loadPrivateKeyFromFile with a key file whose algorithm is not RSA or EC — typically Ed25519 or DSA keys, or keys in a format (PKCS#1, encrypted PEM) that neither KeyFactory can parse.","commonSituations":"Generating modern SSH/OpenSSL keys that default to Ed25519 and using them in Karate TLS config; using an old DSA certificate; passing a PKCS#1 'BEGIN RSA PRIVATE KEY' file to a JDK expecting PKCS#8.","solutions":["Convert the key to PKCS#8 RSA or EC: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem","Regenerate the key with an RSA algorithm (e.g. openssl genrsa 2048) or EC (ecparam -name prime256v1)","Avoid Ed25519/DSA keys for TLS config consumed by Karate","Check the wrapped cause e2 to distinguish format problems from true algorithm mismatch"],"exampleFix":"// before: Ed25519 key fails to load\n// ssh-keygen -t ed25519 -m PEM ...\n// after: regenerate as RSA and convert to PKCS#8\n// openssl genrsa -out server.key 2048\n// openssl pkcs8 -topk8 -nocrypt -in server.key -out server.pkcs8.key","handlingStrategy":"validation","validationCode":"// detect key algorithm before loading\nstatic String keyAlgorithm(java.io.File keyFile) throws Exception {\n    String pem = java.nio.file.Files.readString(keyFile.toPath());\n    if (pem.contains(\"BEGIN RSA\")) return \"RSA\";\n    if (pem.contains(\"BEGIN EC\")) return \"EC\";\n    return \"UNKNOWN\"; // Ed25519/DSA/etc will fail in Karate\n}","typeGuard":"static boolean isSupportedKey(File f) throws Exception { String a = keyAlgorithm(f); return a.equals(\"RSA\") || a.equals(\"EC\"); }","tryCatchPattern":"try { return SslUtils.privateKey(keyBytes); } catch (RuntimeException e) { if (e.getMessage().contains(\"unsupported algorithm\")) { throw new IllegalStateException(\"convert key to PKCS#8 RSA/EC\"); } throw e; }","preventionTips":["Generate keys as RSA or EC for test fixtures","Convert keys to PKCS#8 format","Never use Ed25519/DSA keys with this loader"],"tags":["ssl","private-key","crypto","rsa","ec"],"backgroundTag":"unsupported-operation","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}