{"record":{"id":"48df45a933201bde","repo":"apache/beam","slug":"can-t-create-private-key-e-getmessage","errorCode":null,"errorMessage":"Can't create private key: + e.getMessage()","messagePattern":"Can't create private key: \\+ e\\.getMessage\\(\\)","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java","lineNumber":106,"sourceCode":"        PKCS8EncodedKeySpec encodedKeySpec =\n            pkInfo.getKeySpec(pbeKeyFactory.generateSecret(keySpec));\n        return keyFactory.generatePrivate(encodedKeySpec);\n      }\n    } catch (NoSuchAlgorithmException e) {\n      throw new RuntimeException(\n          \"Private key encryption algorithm not supported. This may mean that the private key was generated by OpenSSL 1.1.1g or newer \"\n              + \"which uses an encryption algorithm by default which has compatibility issues in some JVM environments. \"\n              + \"For details, see: \"\n              + \"https://community.snowflake.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID\"\n              + \" \"\n              + e.getMessage());\n    } catch (InvalidKeySpecException\n        | IOException\n        | IllegalArgumentException\n        | NullPointerException\n        | InvalidKeyException\n        | DecoderException e) {\n      throw new RuntimeException(\"Can't create private key: \" + e.getMessage(), e);\n    }\n  }\n\n  /**\n   * Tries to determine whether the private key is encrypted or not based on the file headers.\n   *\n   * <p>If this is not possible (e.g. there are no headers), returns {@link\n   * KeyEncryptionState#UNKNOWN}\n   */\n  private static KeyEncryptionState guessKeyEncryptionState(String privateKey) {\n    PemReader pr = new PemReader(new StringReader(privateKey));\n    try {\n      PemObject pemObject = pr.readPemObject();\n      if (pemObject == null) {\n        // If it is not a PEM file then it is not possible to determine the encryption state\n        return KeyEncryptionState.UNKNOWN;\n      }\n      if (ENCRYPTED_PRIVATE_KEY.equals(pemObject.getType())) {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java#L88-L124","documentation":"preparePrivateKey wraps InvalidKeySpecException, IOException, IllegalArgumentException, NullPointerException, InvalidKeyException, and DecoderException in a RuntimeException with this message. It means the PEM content could not be parsed, decoded (Base64/hex), or converted into an RSA PrivateKey.","triggerScenarios":"Passing malformed PEM text (missing header/footer), non-Base64 body, an empty/whitespace string, a truncated key, or a value read from a file/path instead of the key contents itself.","commonSituations":"Storing the key in a property file where newlines are mangled (\\\\n escaping issues); accidentally passing a file path rather than the file's contents; env var stripping newlines; copying the key with extra whitespace or missing footer.","solutions":["Verify you are passing the PEM file's CONTENTS (including -----BEGIN/END----- lines), not a file path.","Check the PEM is intact: valid Base64 body and matching BEGIN/END headers; re-copy from source with correct newlines.","Inspect the cause's message (getCause()) to identify which parsing step failed.","Regenerate or re-export the key (openssl pkcs8 -topk8 ...) if the file itself is truncated/corrupt."],"exampleFix":"// before\nString key = \"/etc/snowflake/rsa_key.p8\";                 // wrong: path\nKeyPairUtils.preparePrivateKey(key, passphrase);\n// after\nString key = Files.readString(Path.of(\"/etc/snowflake/rsa_key.p8\"));\nKeyPairUtils.preparePrivateKey(key, passphrase);","handlingStrategy":"validation","validationCode":"if (pem == null || !pem.contains(\"-----BEGIN\") || !pem.contains(\"PRIVATE KEY-----\")) {\n  throw new IllegalArgumentException(\"Value must be PEM private key contents, not a path or truncated text\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  PrivateKey pk = KeyPairUtils.preparePrivateKey(pem, passphrase);\n} catch (RuntimeException e) {\n  if (e.getMessage().startsWith(\"Can't create private key\")) {\n    logger.error(\"PEM parse failed; check contents/newlines. Cause: {}\", e.getCause());\n  }\n  throw e;\n}","preventionTips":["Read the key from a file with Files.readString rather than pasting through env vars that may strip newlines.","Verify BEGIN/END markers and Base64 body before deploying.","Log the first/last line of the key (not the body) when debugging."],"tags":["snowflake","private-key","pem","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}