{"record":{"id":"2cc8917138b15c28","repo":"coredns/coredns","slug":"no-private-key-found","errorCode":null,"errorMessage":"no private key found","messagePattern":"no private key found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/dnssec/dnskey.go","lineNumber":74,"sourceCode":"\tdk, ok := k.(*dns.DNSKEY)\n\tif !ok {\n\t\treturn nil, errors.New(\"no public key found\")\n\t}\n\tp, e := dk.ReadPrivateKey(f, privFile)\n\tif e != nil {\n\t\treturn nil, e\n\t}\n\n\tif s, ok := p.(*rsa.PrivateKey); ok {\n\t\treturn &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil\n\t}\n\tif s, ok := p.(*ecdsa.PrivateKey); ok {\n\t\treturn &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil\n\t}\n\tif s, ok := p.(ed25519.PrivateKey); ok {\n\t\treturn &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil\n\t}\n\treturn nil, errors.New(\"no private key found\")\n}\n\n// ParseKeyFromAWSSecretsManager retrieves and parses a DNSSEC key pair from AWS Secrets Manager.\nfunc ParseKeyFromAWSSecretsManager(secretID string) (*DNSKEY, error) {\n\t// Load the AWS SDK configuration\n\tcfg, err := config.LoadDefaultConfig(context.TODO())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Create a Secrets Manager client\n\tclient := secretsmanager.NewFromConfig(cfg)\n\n\t// Retrieve the secret value\n\tinput := &secretsmanager.GetSecretValueInput{\n\t\tSecretId: &secretID,\n\t}\n\tresult, err := client.GetSecretValue(context.TODO(), input)","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/coredns/coredns/blob/558c9757a92b361e550bdba82d0b4ddf3d12d595/plugin/dnssec/dnskey.go#L56-L92","documentation":"After reading and parsing the DNSKEY public record and its private key material, ParseKeyFile returns 'no private key found' when the parsed private key is not one of the supported types (RSA, ECDSA, or Ed25519). The algorithm's private half could not be converted to a signer.","triggerScenarios":"`ParseKeyFile` reads a key pair whose BIND private-key file parses into a Go type outside the supported set (unsupported algorithm, e.g. certain Ed448/DSA keys), so none of the type assertions on the parsed private key match.","commonSituations":"Using dnssec-keygen algorithms not supported by miekg/dns or this plugin version; a `.private` file of unexpected format; plugin/binary built without the needed crypto support.","solutions":["Generate keys with a supported algorithm (e.g. RSASHA256/ECDSAP256SHA256/Ed25519) using `dnssec-keygen -a ECDSAP256SHA256`","Ensure the matching `.private` file sits next to the `.key` file and is not corrupted","Upgrade CoreDNS/miekg/dns to a version supporting your key algorithm"],"exampleFix":"// before\ndnssec-keygen -a ED448 example.org\n// after\ndnssec-keygen -a ECDSAP256SHA256 example.org","handlingStrategy":"validation","validationCode":"// Only use algorithms with supported private key types\nsupported := map[string]bool{\"RSASHA256\": true, \"ECDSAP256SHA256\": true, \"ECDSAP384SHA384\": true, \"ED25519\": true}\nif !supported[algo] {\n    return fmt.Errorf(\"algorithm %s not supported for dnssec signing\", algo)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate keys only with algorithms supported by CoreDNS/miekg/dns","Keep the .private file beside the .key file and uncorrupted","Upgrade CoreDNS if you must use newer algorithms (e.g. Ed448)"],"tags":["coredns","dnssec","key-parsing","unsupported-algorithm"],"backgroundTag":"unsupported-operation","analyzedSha":"558c9757a92b361e550bdba82d0b4ddf3d12d595","analyzedAt":"2026-09-06T22:47:02.106Z","contentChangedAt":"2026-09-06T22:47:02.106Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}