{"record":{"id":"2b0ebd6819e50cb1","repo":"hashicorp/nomad","slug":"error-encoding-private-key-s","errorCode":null,"errorMessage":"error encoding private key: %s","messagePattern":"error encoding private key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":60,"sourceCode":"\n\tbs, err := x509.MarshalECPrivateKey(pk)\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"error marshaling ECDSA private key: %s\", err)\n\t}\n\n\tpemBlock, err := pemEncodeKey(bs, \"EC PRIVATE KEY\")\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\n\treturn pk, pemBlock, nil\n}\n\nfunc pemEncodeKey(key []byte, blockType string) (string, error) {\n\tvar buf bytes.Buffer\n\n\tif err := pem.Encode(&buf, &pem.Block{Type: blockType, Bytes: key}); err != nil {\n\t\treturn \"\", fmt.Errorf(\"error encoding private key: %s\", err)\n\t}\n\treturn buf.String(), nil\n}\n\ntype CAOpts struct {\n\tSigner              crypto.Signer\n\tSerial              *big.Int\n\tDays                int\n\tPermittedDNSDomains []string\n\tCountry             string\n\tPostalCode          string\n\tProvince            string\n\tLocality            string\n\tStreetAddress       string\n\tOrganization        string\n\tOrganizationalUnit  string\n\tName                string\n}","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L42-L78","documentation":"pemEncodeKey wraps the DER bytes of a private key in a PEM block of the given type (e.g. \"EC PRIVATE KEY\") using pem.Encode. If PEM encoding to the in-memory buffer fails, the error is wrapped with this message. pem.Encode rarely fails, making this an exceptional defensive path.","triggerScenarios":"pem.Encode returns a non-nil error while pemEncodeKey encodes marshaled private-key bytes during GeneratePrivateKey.","commonSituations":"Practically unreachable with valid DER input; would only surface from anomalies in the bytes.Buffer or pem writer.","solutions":["Inspect the wrapped underlying error for the real cause.","Retry generation; regenerate the key/cert pair.","Report to the maintainers if reproducible, since pem.Encode of valid DER should not fail."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"signer, pemKey, err := tlsutil.GeneratePrivateKey()\nif err != nil {\n    if strings.Contains(err.Error(), \"error encoding private key\") {\n        return fmt.Errorf(\"pem encode failed: %w\", err)\n    }\n    return err\n}","preventionTips":["Use the library's generation path as-is; do not hand-roll key bytes.","Treat this as an internal invariant failure and report if it occurs.","Retry generation on failure."],"tags":["tls","pem","encoding"],"backgroundTag":"pem-encoding-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}