{"record":{"id":"476df96f9ba72659","repo":"denoland/deno","slug":"if-keyformat-is-specified-it-must-be-pem-rec","errorCode":null,"errorMessage":"If \"keyFormat\" is specified, it must be \"pem\": received \"${keyFormat}\"","messagePattern":"If \"keyFormat\" is specified, it must be \"pem\": received \"(.+?)\"","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/net/02_tls.js","lineNumber":142,"sourceCode":"}\n\n/**\n * Loads a TLS keypair from one of the various options. If no key material is provided,\n * returns a special Null keypair.\n */\nfunction loadTlsKeyPair(api, {\n  keyFormat,\n  cert,\n  key,\n}) {\n  // TODO(mmastrac): remove this temporary symbol when the API lands\n  if (arguments[1][resolverSymbol] !== undefined) {\n    return createTlsKeyResolver(arguments[1][resolverSymbol]);\n  }\n\n  // Check for \"pem\" format\n  if (keyFormat !== undefined && keyFormat !== \"pem\") {\n    throw new TypeError(\n      `If \"keyFormat\" is specified, it must be \"pem\": received \"${keyFormat}\"`,\n    );\n  }\n\n  if (cert !== undefined && key === undefined) {\n    throw new TypeError(\n      `If \\`cert\\` is specified, \\`key\\` must be specified as well for \\`${api}\\``,\n    );\n  }\n  if (cert === undefined && key !== undefined) {\n    throw new TypeError(\n      `If \\`key\\` is specified, \\`cert\\` must be specified as well for \\`${api}\\``,\n    );\n  }\n\n  if (cert !== undefined) {\n    return op_tls_key_static(cert, key);\n  } else {","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/net/02_tls.js#L124-L160","documentation":"Deno's TLS key-pair loader (loadTlsKeyPair, used by Deno.connectTls and Deno.listenTls) accepts a keyFormat option, but only the PEM format is implemented: any value other than 'pem' (undefined also means PEM) throws this TypeError. DER and PKCS#12 key material are not supported.","triggerScenarios":"Deno.connectTls({ cert, key, keyFormat: 'der' }); values translated from Node's secure-context options such as 'pkcs8' or 'p12'; config files supplying uppercase 'PEM' (the check is case-sensitive lowercase 'pem').","commonSituations":"Converting Node tls.createSecureContext options to Deno; keys generated via openssl DER output formats; configuration systems that always populate format fields with a default like 'PEM'.","solutions":["Convert key and certificate to PEM (base64 bodies with BEGIN/END headers) and omit keyFormat","If specifying the field, use exactly the lowercase string 'pem'","Generate PEM directly: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes"],"exampleFix":"# before: DER material + keyFormat: 'der'\nopenssl rsa -in key.der -inform DER -out key.der  # still DER\n\n# after: convert to PEM and drop keyFormat\nopenssl rsa -in key.der -inform DER -out key.pem -outform PEM\nopenssl x509 -in cert.der -inform DER -out cert.pem -outform PEM","handlingStrategy":"validation","validationCode":"if (keyFormat !== undefined && keyFormat !== 'pem') {\n  throw new Error(`only PEM keys are supported; convert ${keyFormat} to PEM before calling`);\n}","typeGuard":"function isPemFormat(f: unknown): f is 'pem' | undefined {\n  return f === undefined || f === 'pem';\n}","tryCatchPattern":"try {\n  await Deno.connectTls({ hostname, port, cert, key, keyFormat });\n} catch (e) {\n  if (e instanceof TypeError && e.message.includes('keyFormat')) {\n    throw new Error('convert key/cert to PEM and drop keyFormat');\n  }\n  throw e;\n}","preventionTips":["Standardize on PEM files (BEGIN/END blocks) for all Deno TLS material","Omit keyFormat unless a future Deno release documents more formats","Watch for case: the accepted literal is lowercase 'pem'"],"tags":["deno","tls","certificate","key-format","typeerror"],"backgroundTag":"tls-certificate-configuration","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}