{"record":{"id":"4831c62a44c015d2","repo":"jenkinsci/jenkins","slug":"unsupported-private-key-file-format-key","errorCode":null,"errorMessage":"Unsupported private key file format: key","messagePattern":"Unsupported private key file format: key","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"cli/src/main/java/hudson/cli/PrivateKeyProvider.java","lineNumber":151,"sourceCode":"    private static String readPemFile(File f) throws IOException {\n        try (InputStream is = Files.newInputStream(f.toPath());\n             DataInputStream dis = new DataInputStream(is)) {\n            byte[] bytes = new byte[(int) f.length()];\n            dis.readFully(bytes);\n            return new String(bytes, StandardCharsets.UTF_8);\n        } catch (InvalidPathException e) {\n            throw new IOException(e);\n        }\n    }\n\n    public static KeyPair loadKey(String pemString, String passwd) throws IOException, GeneralSecurityException {\n        Iterable<KeyPair> itr = SecurityUtils.loadKeyPairIdentities(null,\n                new PathResource(Paths.get(\"key\")),\n                new ByteArrayInputStream(pemString.getBytes(StandardCharsets.UTF_8)),\n                FilePasswordProvider.of(passwd));\n        long numLoaded = itr == null ? 0 : StreamSupport.stream(itr.spliterator(), false).count();\n        if (numLoaded <= 0) {\n            throw new InvalidKeyException(\"Unsupported private key file format: key\");\n        }\n        if (numLoaded != 1) {\n            throw new InvalidKeySpecException(\"Multiple private key pairs N/A: key\");\n        }\n        return itr.iterator().next();\n    }\n\n    private static final Logger LOGGER = Logger.getLogger(PrivateKeyProvider.class.getName());\n}\n","sourceCodeStart":133,"sourceCodeEnd":161,"githubUrl":"https://github.com/jenkinsci/jenkins/blob/2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc/cli/src/main/java/hudson/cli/PrivateKeyProvider.java#L133-L161","documentation":"InvalidKeyException thrown by PrivateKeyProvider.loadKey when SecurityUtils.loadKeyPairIdentities (Apache MINA/SSHD) parses zero key pairs from the supplied PEM string. The data was not recognized as any supported private key format (RSA, DSA, ECDSA, EdDSA in PEM/OpenSSH form).","triggerScenarios":"Passing -i with a file that is a public key, a certificate, an SSH config, an empty/truncated file, or a key in a format the bundled SSHD version cannot parse (e.g. PKCS#12, or a newer OpenSSH format on an older library).","commonSituations":"Wrong file passed to -i (pubkey instead of private key); key generated with a very new OpenSSH format not yet supported by the bundled SSHD; file encoding/BOM issues; copy-paste truncation of the PEM block.","solutions":["Confirm the -i file is the private key (begins with '-----BEGIN ... PRIVATE KEY-----').","If using a new OpenSSH key format, convert it to PEM with 'ssh-keygen -p -m PEM -f key' or generate a key in a supported format.","Ensure the CLI/SSHD library version supports the key type (upgrade Jenkins/CLI if using Ed25519 or ECDSA on an old build)."],"exampleFix":"# before: unsupported OpenSSH new format\nssh-keygen -t ed25519 -f key\njava -jar jenkins-cli.jar -i key -s http://j ... \n# after: convert to PEM\nssh-keygen -p -m PEM -f key\njava -jar jenkins-cli.jar -i key -s http://j ...","handlingStrategy":"validation","validationCode":"// Validate the file looks like a supported private key before passing to -i\nString pem = Files.readString(Path.of(keyFile));\nboolean looksValid = pem.contains(\"-----BEGIN\") && pem.contains(\"PRIVATE KEY-----\");\nif (!looksValid) {\n    throw new IllegalArgumentException(keyFile + \" is not a recognizable private key\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    PrivateKeyProvider.loadKey(pem, passwd);\n} catch (InvalidKeyException e) {\n    // prompt the user to supply a valid PEM private key or convert the format\n}","preventionTips":["Verify the -i file is a private key (BEGIN ... PRIVATE KEY header).","Convert new OpenSSH keys to PEM before use with old CLI builds.","Keep the CLI/SSHD library recent enough to support modern key types."],"tags":["jenkins-cli","ssh","private-key","authentication"],"backgroundTag":null,"analyzedSha":"2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc","analyzedAt":"2026-08-14T07:07:15.274Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}