{"record":{"id":"3d845e504ed3fc84","repo":"ory/hydra","slug":"square-go-jose-parse-error-got-s-s-s","errorCode":null,"errorMessage":"square/go-jose: parse error, got '%s', '%s', '%s' and '%s'","messagePattern":"square/go-jose: parse error, got '(.+?)', '(.+?)', '(.+?)' and '(.+?)'","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/josex/utils.go","lineNumber":102,"sourceCode":"\t\treturn priv, nil\n\t}\n\n\tpriv, err1 := x509.ParsePKCS8PrivateKey(input)\n\tif err1 == nil {\n\t\treturn priv, nil\n\t}\n\n\tpriv, err2 := x509.ParseECPrivateKey(input)\n\tif err2 == nil {\n\t\treturn priv, nil\n\t}\n\n\tjwk, err3 := LoadJSONWebKey(input, false)\n\tif err3 == nil {\n\t\treturn jwk, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"square/go-jose: parse error, got '%s', '%s', '%s' and '%s'\", err0, err1, err2, err3)\n}\n","sourceCodeStart":84,"sourceCodeEnd":104,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/josex/utils.go#L84-L104","documentation":"Aggregated parse error from LoadPrivateKey: none of the four attempted formats (PKCS1, PKCS8, EC PEM, JWK) succeeded, and the message embeds each attempt's underlying error so the real cause of the malformed private key can be diagnosed.","triggerScenarios":"Calling josex.LoadPrivateKey with a public key instead of a private key, a certificate PEM, encrypted (password-protected) private key PEM, raw base64 of key material, or corrupt/empty data.","commonSituations":"Swapped pub/priv file paths in config; passphrase-protected 'ENCRYPTED PRIVATE KEY' blocks the parser cannot read; Kubernetes secrets mounted truncated; copied keys with HTML entities or escaped newlines.","solutions":["Read err0..err3 in the message to see each parse failure reason","Confirm the input is an unencrypted PEM PRIVATE KEY (PKCS1 or PKCS8), DER private key, or JWK with a private 'd' component","Decrypt password-protected keys before passing them in (openssl pkey -in key.pem)","If you passed a public key or certificate, load the actual private key file","Check for whitespace/newline mangling when keys come from env vars"],"exampleFix":"// before\nkey, err := josex.LoadPrivateKey(certPEM) // 'BEGIN CERTIFICATE'\n// after\nkey, err := josex.LoadPrivateKey(privPEM) // 'BEGIN PRIVATE KEY'","handlingStrategy":"validation","validationCode":"func looksLikePrivateKey(data []byte) error {\n    s := strings.TrimSpace(string(data))\n    switch {\n    case strings.Contains(s, \"BEGIN ENCRYPTED PRIVATE KEY\") || strings.Contains(s, \"ENCRYPTED PRIVATE KEY\"):\n        return errors.New(\"key is passphrase-protected; decrypt before loading\")\n    case strings.Contains(s, \"BEGIN CERTIFICATE\") || strings.Contains(s, \"BEGIN PUBLIC KEY\"):\n        return errors.New(\"got a public key/certificate; LoadPrivateKey needs a private key\")\n    case strings.Contains(s, \"BEGIN PRIVATE KEY\"), strings.Contains(s, \"BEGIN RSA PRIVATE KEY\"), strings.HasPrefix(s, \"{\\\"kty\\\"\"):\n        return nil\n    default:\n        return errors.New(\"input is not a PEM private key, DER private key, or JWK\")\n    }\n}","typeGuard":"func isPEMPrivateKey(data []byte) bool {\n    s := string(data)\n    return strings.Contains(s, \"BEGIN PRIVATE KEY\") || strings.Contains(s, \"BEGIN RSA PRIVATE KEY\")\n}","tryCatchPattern":"key, err := josex.LoadPrivateKey(data)\nif err != nil {\n    return fmt.Errorf(\"invalid private key material: %w\", err)\n}","preventionTips":["Keep public and private keys in separate, clearly named files and double-check paths in config","Decrypt passphrase-protected PEMs at provisioning time (openssl pkey)","Watch for newline mangling when keys pass through env vars or secrets templates","Load all crypto material at startup so bad keys fail fast, not on first request"],"tags":["jose","jwk","pem","key-parsing","go"],"backgroundTag":"key-parse-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}