{"record":{"id":"4553a772692cc00d","repo":"caddyserver/caddy","slug":"encrypted-private-keys-are-not-supported-please-d-4553a7","errorCode":null,"errorMessage":"encrypted private keys are not supported; please decrypt the key first","messagePattern":"encrypted private keys are not supported; please decrypt the key first","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/folderloader.go","lineNumber":166,"sourceCode":"\t\t\t\tfoundKey = true\n\t\t\t}\n\t\t} else {\n\t\t\treturn tls.Certificate{}, fmt.Errorf(\"unrecognized PEM block type: %s\", derBlock.Type)\n\t\t}\n\t}\n\n\tcertPEMBytes, keyPEMBytes := certBuilder.Bytes(), keyBuilder.Bytes()\n\tif len(certPEMBytes) == 0 {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"failed to parse PEM data\")\n\t}\n\tif len(keyPEMBytes) == 0 {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"no private key block found\")\n\t}\n\n\t// if the start of the key file looks like an encrypted private key,\n\t// reject it with a helpful error message\n\tif strings.HasPrefix(string(keyPEMBytes[:40]), \"ENCRYPTED\") {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"encrypted private keys are not supported; please decrypt the key first\")\n\t}\n\n\tcert, err := tls.X509KeyPair(certPEMBytes, keyPEMBytes)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"making X509 key pair: %v\", err)\n\t}\n\n\treturn cert, nil\n}\n\nvar (\n\t_ CertificateLoader = (FolderLoader)(nil)\n\t_ caddy.Provisioner = (FolderLoader)(nil)\n)\n","sourceCodeStart":148,"sourceCodeEnd":181,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/folderloader.go#L148-L181","documentation":"Error \"encrypted private keys are not supported; please decrypt the key first\" thrown in caddyserver/caddy.","triggerScenarios":"Thrown at modules/caddytls/folderloader.go:166 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Decrypt the private key first, e.g. with 'openssl rsa -in key.pem -out key-decrypted.pem', then configure Caddy with the decrypted key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}