{"record":{"id":"4583371f897ae982","repo":"risingwavelabs/risingwave","slug":"no-private-key-found","errorCode":null,"errorMessage":"No private key found","messagePattern":"No private key found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/common.rs","lineNumber":1305,"sourceCode":"\n    CertificateDer::pem_slice_iter(&cert_bytes)\n        .collect::<Result<Vec<_>, _>>()\n        .context(\"failed to parse certificates\")\n        .map_err(Into::into)\n}\n\npub(crate) fn load_private_key(\n    certificate: &str,\n) -> ConnectorResult<rustls_pki_types::PrivateKeyDer<'static>> {\n    let cert_bytes = if let Some(path) = certificate.strip_prefix(\"fs://\") {\n        std::fs::read_to_string(path).map(|cert| cert.as_bytes().to_owned())?\n    } else {\n        certificate.as_bytes().to_owned()\n    };\n\n    let cert = PrivatePkcs8KeyDer::pem_slice_iter(&cert_bytes)\n        .next()\n        .ok_or_else(|| anyhow!(\"No private key found\"))?\n        .context(\"failed to parse the private key\")?;\n    Ok(cert.into())\n}\n\n#[serde_as]\n#[derive(Deserialize, Debug, Clone, WithOptions)]\npub struct MongodbCommon {\n    /// The URL of `MongoDB`\n    #[serde(rename = \"mongodb.url\")]\n    pub connect_uri: String,\n    /// The collection name where data should be written to or read from. For sinks, the format is\n    /// `db_name.collection_name`. Data can also be written to dynamic collections, see `collection.name.field`\n    /// for more information.\n    #[serde(rename = \"collection.name\")]\n    pub collection_name: String,\n}\n\nimpl EnforceSecret for MongodbCommon {","sourceCodeStart":1287,"sourceCodeEnd":1323,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/common.rs#L1287-L1323","documentation":"Thrown by `load_private_key` when building TLS credentials. The function iterates PEM sections with `PrivatePkcs8KeyDer::pem_slice_iter` looking for a PKCS#8 private key block, and this error is raised when no such block is present in the supplied string or file. Only PKCS#8 (`-----BEGIN PRIVATE KEY-----`) format is accepted by this parser.","triggerScenarios":"Passing a value to the private-key option (TLS config) whose bytes contain no `-----BEGIN PRIVATE KEY-----` PEM section — e.g. an empty string, a file containing only the certificate, or a key in PKCS#1 (`BEGIN RSA PRIVATE KEY`) or SECG1 (`BEGIN EC PRIVATE KEY`) legacy formats.","commonSituations":"Providing the certificate path where the key path is expected; a key file with legacy `RSA PRIVATE KEY` headers instead of PKCS#8; missing `fs://` prefix so an inline value is parsed as a path (or vice versa); empty/unreadable key file contents after `fs://` read.","solutions":["Convert the key to PKCS#8 format, e.g. `openssl pkcs8 -topk8 -nocrypt -in key.pem -out key_pkcs8.pem`, and use that.","Check that the private-key option points to (or inline contains) the actual key file, not the certificate.","Verify the file contents contain a `-----BEGIN PRIVATE KEY-----` block (`grep 'PRIVATE KEY' key.pem`).","If using a file, ensure the `fs://` prefix is present; if inlining, ensure the PEM text is fully included."],"exampleFix":"// before\nkey = \"-----BEGIN RSA PRIVATE KEY-----\\nMIIEpA...\";\n// after\nkey = \"-----BEGIN PRIVATE KEY-----\\nMIIEvQ...\"; // converted with openssl pkcs8 -topk8 -nocrypt","handlingStrategy":"validation","validationCode":"fn has_pkcs8_pem(s: &str) -> bool { s.contains(\"-----BEGIN PRIVATE KEY-----\") }\nif !has_pkcs8_pem(key_input) { return Err(\"private key must be PKCS#8 PEM (BEGIN PRIVATE KEY)\"); }","typeGuard":"fn is_pkcs8_key_pem(s: &str) -> bool {\n    s.contains(\"-----BEGIN PRIVATE KEY-----\") && !s.contains(\"RSA PRIVATE KEY\") && !s.contains(\"EC PRIVATE KEY\")\n}","tryCatchPattern":"let key = load_private_key(&cfg.tls_key).map_err(|e| match e.to_string().as_str() {\n    \"No private key found\" => ConfigError::new(\"key file has no PKCS#8 PEM block; convert with `openssl pkcs8 -topk8 -nocrypt`\"),\n    _ => e.into(),\n})?;","preventionTips":["Always store keys in PKCS#8 format (`BEGIN PRIVATE KEY` header)","Double-check key vs certificate paths in TLS options","Keep key files non-empty and readable; validate contents before startup"],"tags":["tls","rustls","pem","private-key"],"backgroundTag":"missing-credentials","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}