{"record":{"id":"3638a48ea97807c1","repo":"prestodb/presto","slug":"arrow-flight-invalid-key-error","errorCode":"ARROW_FLIGHT_INVALID_KEY_ERROR","errorMessage":"Error creating flight client, invalid key file: ","messagePattern":"Error creating flight client, invalid key file: ","errorType":"error_code","errorClass":"ArrowException","httpStatus":null,"severity":"error","filePath":"presto-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/BaseArrowFlightClientHandler.java","lineNumber":93,"sourceCode":"        Optional<InputStream> clientKey = Optional.empty();\n        try {\n            FlightClient.Builder flightClientBuilder = FlightClient.builder(allocator, location);\n            flightClientBuilder.verifyServer(config.getVerifyServer());\n            if (config.getFlightServerSSLCertificate() != null) {\n                trustedCertificate = Optional.of(newInputStream(Paths.get(config.getFlightServerSSLCertificate())));\n                flightClientBuilder.trustedCertificates(trustedCertificate.get()).useTls();\n            }\n            if (config.getFlightClientSSLCertificate() != null && config.getFlightClientSSLKey() != null) {\n                clientCertificate = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLCertificate())));\n                clientKey = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLKey())));\n                flightClientBuilder.clientCertificate(clientCertificate.get(), clientKey.get()).useTls();\n            }\n\n            return flightClientBuilder.build();\n        }\n        catch (Exception e) {\n            if (e.getCause() instanceof InvalidKeyException) {\n                throw new ArrowException(ARROW_FLIGHT_INVALID_KEY_ERROR, \"Error creating flight client, invalid key file: \" + e.getMessage(), e);\n            }\n            else if (e.getCause() instanceof CertificateException) {\n                throw new ArrowException(ARROW_FLIGHT_INVALID_CERT_ERROR, \"Error creating flight client, invalid certificate file: \" + e.getMessage(), e);\n            }\n            else {\n                throw new ArrowException(ARROW_FLIGHT_CLIENT_ERROR, \"Error creating flight client: \" + e.getMessage(), e);\n            }\n        }\n        finally {\n            if (trustedCertificate.isPresent()) {\n                try {\n                    trustedCertificate.get().close();\n                }\n                catch (IOException e) {\n                    logger.error(\"Error closing input stream for server certificate\", e);\n                }\n            }\n            if (clientCertificate.isPresent()) {","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/BaseArrowFlightClientHandler.java#L75-L111","documentation":"BaseArrowFlightClientHandler.createFlightClient builds a FlightClient with TLS material. When the exception chain contains a java.security.InvalidKeyException — the configured private key file is invalid or unreadable as a key — it is wrapped as ArrowException(ARROW_FLIGHT_INVALID_KEY_ERROR) with 'Error creating flight client, invalid key file: <msg>'. This indicates the client-side key used for mTLS is malformed, in the wrong format, or protected in an unsupported way.","triggerScenarios":"Calling createFlightClient (directly or via getFlightInfo/getSchema/any RPC) when loading the configured client key file into the SSL context throws InvalidKeyException (usually wrapped deeper, hence the getCause() walk).","commonSituations":"Key file in PKCS#8 vs PKCS#1 mismatch with the loader; encrypted key supplied without passphrase config; truncated or corrupted key file; key downloaded from a secret store with wrong encoding; Java version lacking support for the key algorithm.","solutions":["Open the key file and validate its format (PEM headers, PKCS#8 'BEGIN PRIVATE KEY' vs PKCS#1 'BEGIN RSA PRIVATE KEY').","Convert the key with openssl, e.g. `openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem`.","If the key is encrypted, configure the passphrase or remove encryption.","Re-export/re-download the key from your secret manager to rule out truncation/corruption.","Verify the key matches the certificate (same modulus/public key) issued for mTLS."],"exampleFix":"# before: PKCS#1 key not accepted by JDK loader\n-----BEGIN RSA PRIVATE KEY-----\n# after: convert to PKCS#8\nopenssl pkcs8 -topk8 -nocrypt -in client.key -out client-pkcs8.key","handlingStrategy":"validation","validationCode":"// Validate the key file parses before creating the client\nbyte[] pem = java.nio.file.Files.readAllBytes(java.nio.file.Path.of(keyPath));\nString s = new String(pem, java.nio.file.StandardCharsets.US_ASCII);\nif (!s.contains(\"BEGIN PRIVATE KEY\") && !s.contains(\"BEGIN RSA PRIVATE KEY\")) {\n    throw new IllegalStateException(\"Not a PEM key file: \" + keyPath);\n}\n// Optional hard check:\njava.security.KeyFactory.getInstance(\"RSA\")\n    .generatePrivate(new java.security.spec.PKCS8EncodedKeySpec(parsePkcs8(pem)));","typeGuard":null,"tryCatchPattern":"try {\n    FlightClient client = handler.createFlightClient();\n} catch (ArrowException e) {\n    if (e.getErrorCode().getCode() == ARROW_FLIGHT_INVALID_KEY_ERROR.getCode()) {\n        // fix key file format/passphrase, then rebuild client\n    }\n    throw e;\n}","preventionTips":["Standardize on PKCS#8 PEM keys for all Flight mTLS configs.","Validate key/cert pairs with `openssl pkey -in key.pem -check` and `openssl x509 -pubkey` matching.","Never point key config at an encrypted key without configuring the passphrase.","Check deployed key files for truncation after secret-manager pulls."],"tags":["presto","arrow-flight","tls","key","mtls"],"backgroundTag":"invalid-tls-key","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}