{"record":{"id":"48fd2d3d48d8ac22","repo":"AdguardTeam/AdGuardHome","slug":"tls-found-unknown-private-key-type-t-in-pkcs-8-w","errorCode":null,"errorMessage":"tls: found unknown private key type %T in PKCS#8 wrapping","messagePattern":"tls: found unknown private key type %T in PKCS#8 wrapping","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/aghtls/defaultmanager.go","lineNumber":937,"sourceCode":"// OpenSSL ecparam generates SEC1 EC private keys for ECDSA.  We try all three.\n//\n// TODO(a.garipov): Find out if this version of parsePrivateKey from the stdlib\n// is actually necessary.\nfunc parsePrivateKey(der []byte) (key crypto.PrivateKey, typ string, err error) {\n\tif key, err = x509.ParsePKCS1PrivateKey(der); err == nil {\n\t\treturn key, keyTypeRSA, nil\n\t}\n\n\tif key, err = x509.ParsePKCS8PrivateKey(der); err == nil {\n\t\tswitch key := key.(type) {\n\t\tcase *rsa.PrivateKey:\n\t\t\treturn key, keyTypeRSA, nil\n\t\tcase *ecdsa.PrivateKey:\n\t\t\treturn key, keyTypeECDSA, nil\n\t\tcase ed25519.PrivateKey:\n\t\t\treturn key, keyTypeED25519, nil\n\t\tdefault:\n\t\t\treturn nil, \"\", fmt.Errorf(\n\t\t\t\t\"tls: found unknown private key type %T in PKCS#8 wrapping\",\n\t\t\t\tkey,\n\t\t\t)\n\t\t}\n\t}\n\n\tif key, err = x509.ParseECPrivateKey(der); err == nil {\n\t\treturn key, keyTypeECDSA, nil\n\t}\n\n\treturn nil, \"\", errors.Error(\"tls: failed to parse private key\")\n}\n","sourceCodeStart":919,"sourceCodeEnd":950,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/aghtls/defaultmanager.go#L919-L950","documentation":"A PKCS#8-wrapped private key parsed successfully but its algorithm is not RSA, ECDSA, or Ed25519 — the type switch in parsePrivateKey found an unexpected Go key type.","triggerScenarios":"Extremely rare: a PKCS#8 structure carrying an unsupported algorithm OID (e.g., DSA, or an exotic/unknown algorithm) reaches x509.ParsePKCS8PrivateKey and yields a key type outside the supported set.","commonSituations":"Keys generated by nonstandard tooling emitting DSA or experimental algorithm OIDs in PKCS#8; corrupted-but-parsable key data producing an unexpected type.","solutions":["Regenerate the key with a supported algorithm: RSA (>=2048), ECDSA (P-256), or standard tooling","Inspect the key: openssl pkey -in key.pem -noout -text to identify the algorithm","If Ed25519 was intended, note the library separately rejects it for browser-compatibility reasons; use ECDSA P-256 instead"],"exampleFix":"# before\nopenssl dsaparam / genkey ... # unsupported\n# after\nopenssl ecparam -name prime256v1 -genkey -out key.pem","handlingStrategy":"validation","validationCode":"if k, err := x509.ParsePKCS8PrivateKey(der); err == nil {\n    switch k.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:\n    default:\n        return fmt.Errorf(\"unsupported key algorithm %T\", k)\n    }\n}","typeGuard":"func isSupportedKey(any any) bool {\n    switch any.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := mgr.LoadTLSConfig(ctx, conf); err != nil {\n    if strings.Contains(err.Error(), \"unknown private key type\") { /* regenerate with RSA/ECDSA */ }\n}","preventionTips":["Generate keys only with mainstream algorithms (RSA-2048+, ECDSA P-256)","Avoid DSA and exotic PKCS#8 algorithms for TLS keys"],"tags":["tls","crypto","private-key","pkcs8","algorithm"],"backgroundTag":"unsupported-key-algorithm","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}