{"record":{"id":"3eefbf4100924cf4","repo":"lcobucci/jwt","slug":"it-was-not-possible-to-parse-your-key-reason-opensslerror","errorCode":null,"errorMessage":"It was not possible to parse your key, reason:{opensslError}","messagePattern":"It was not possible to parse your key, reason:(.+?)","errorType":"exception","errorClass":"Lcobucci\\JWT\\Signer\\InvalidKeyProvided","httpStatus":null,"severity":"error","filePath":"src/Signer/OpenSSL.php","lineNumber":91,"sourceCode":"\n        return $result === 1;\n    }\n\n    /** @throws InvalidKeyProvided */\n    private function getPublicKey(Key $key): OpenSSLAsymmetricKey\n    {\n        return $this->validateKey(openssl_pkey_get_public($key->contents()));\n    }\n\n    /**\n     * Raises an exception when the key type is not the expected type\n     *\n     * @throws InvalidKeyProvided\n     */\n    private function validateKey(OpenSSLAsymmetricKey|bool $key): OpenSSLAsymmetricKey\n    {\n        if (is_bool($key)) {\n            throw InvalidKeyProvided::cannotBeParsed($this->fullOpenSSLErrorString());\n        }\n\n        $details = openssl_pkey_get_details($key);\n        assert(is_array($details));\n\n        assert(array_key_exists('bits', $details));\n        assert(is_int($details['bits']));\n        assert(array_key_exists('type', $details));\n        assert(is_int($details['type']));\n\n        $this->guardAgainstIncompatibleKey($details['type'], $details['bits']);\n        $this->guardAgainstIncompatibleCurve($this->curveNameFrom($details));\n\n        return $key;\n    }\n\n    /** @param array<string, mixed> $details */\n    private function curveNameFrom(array $details): ?string","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Signer/OpenSSL.php#L73-L109","documentation":"Thrown by OpenSSL::validateKey when openssl_pkey_get_private/get_public returns false, i.e. OpenSSL could not parse the provided key material at all. The message includes the OpenSSL error buffer with the parse failure reason.","triggerScenarios":"Passing malformed PEM/DER contents, a key missing the BEGIN/END headers (e.g. only base64 body), an X.509 certificate instead of a key, or whitespace-mangled key contents from env vars or JSON config.","commonSituations":"Keys pasted through env vars losing newlines, certificate (cert.pem) used where a key file is expected, base64 re-encoding stripping headers, older PHP without modern key import for certain formats (e.g. PKCS#8 on very old setups).","solutions":["Validate the key parses outside PHP: `openssl pkey -in key.pem -noout`","If storing the key in an env var, use literal \\n escapes and restore newlines before parsing, or load from a file","Make sure you pass a key, not a certificate (extract key: `openssl pkey -in cert.pem -pubout` style, or use the certificate's key)","Verify PEM headers are intact (-----BEGIN ... PRIVATE KEY----- / -----END ...)"],"exampleFix":"// before\n$pem = str_replace('\\n', '', getenv('PRIVATE_KEY')); // newlines lost\n$key = InMemory::plainText($pem);\n// after\n$pem = str_replace('\\\\n', \"\\n\", getenv('PRIVATE_KEY'));\n$key = InMemory::plainText($pem);","handlingStrategy":"validation","validationCode":"if (strpos($pem, '-----BEGIN') !== 0) { throw new InvalidArgumentException('Key must be PEM with BEGIN/END headers'); }","typeGuard":null,"tryCatchPattern":"try { $signer->sign($payload, $key); } catch (\\Jose\\Component\\Signature\\Exception\\InvalidKeyProvided $e) { /* log $e->getMessage() which contains OpenSSL parse reason */ }","preventionTips":["Load keys from files, not env vars, when possible to preserve newlines","Never strip or re-wrap PEM line breaks","Confirm you have a key, not a certificate, before signing"],"tags":["openssl","key","parsing","pem"],"backgroundTag":"invalid-argument-format","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}