{"record":{"id":"4c0ec2bc4d613e88","repo":"apache/beam","slug":"the-private-key-is-unencrypted-but-private-key-key","errorCode":null,"errorMessage":"The private key is unencrypted but private key key passphrase has been provided.","messagePattern":"The private key is unencrypted but private key key passphrase has been provided\\.","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java","lineNumber":64,"sourceCode":"    ENCRYPT,\n    UNENCRYPTED,\n    UNKNOWN\n  }\n\n  @SuppressFBWarnings(\"DCN_NULLPOINTER_EXCEPTION\")\n  public static PrivateKey preparePrivateKey(String privateKey, String privateKeyPassphrase) {\n    try {\n      KeyFactory keyFactory = KeyFactory.getInstance(\"RSA\");\n      KeyEncryptionState encryptionState = guessKeyEncryptionState(privateKey);\n      if (encryptionState == KeyEncryptionState.ENCRYPT\n          && Strings.isNullOrEmpty(privateKeyPassphrase)) {\n        throw new RuntimeException(\n            \"The private key is encrypted but no private key key passphrase has been provided.\");\n      }\n\n      if (encryptionState == KeyEncryptionState.UNENCRYPTED\n          && !Strings.isNullOrEmpty(privateKeyPassphrase)) {\n        throw new RuntimeException(\n            \"The private key is unencrypted but private key key passphrase has been provided.\");\n      }\n\n      byte[] decoded;\n\n      if (encryptionState == KeyEncryptionState.UNKNOWN) {\n        decoded = Base64.decode(privateKey);\n      } else {\n        PemReader pr = new PemReader(new StringReader(privateKey));\n        PemObject pemObject = pr.readPemObject();\n        decoded = pemObject.getContent();\n        pr.close();\n      }\n\n      if (Strings.isNullOrEmpty(privateKeyPassphrase)) {\n        // unencrypted private key file\n        PKCS8EncodedKeySpec encodedKeySpec = new PKCS8EncodedKeySpec(decoded);\n        return keyFactory.generatePrivate(encodedKeySpec);","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java#L46-L82","documentation":"preparePrivateKey validates passphrase consistency: if the PEM key is unencrypted but a non-empty passphrase was supplied, it throws this RuntimeException. The passphrase would be silently ignored otherwise, which the library treats as a configuration mistake.","triggerScenarios":"Passing privateKeyPassphrase to preparePrivateKey while the PEM file has the \"PRIVATE KEY\" (unencrypted) header — typically configured via Snowflake's privateKeyPassphrase property for a key without encryption.","commonSituations":"Config template always includes a passphrase field left filled with a dummy value; switching to an unencrypted key without removing the passphrase setting; copy-pasted config from another environment.","solutions":["Remove the privateKeyPassphrase from the Snowflake configuration since the key is not encrypted.","Or, if you intend to use a passphrase, regenerate the key encrypted: openssl genpkey -aes256 ... / openssl pkcs8 -topk8 -v2 aes-256-cbc.","Verify the key's header: '-----BEGIN PRIVATE KEY-----' means unencrypted; '-----BEGIN ENCRYPTED PRIVATE KEY-----' means encrypted."],"exampleFix":"// before (key is unencrypted)\nconfig.withPrivateKeyPassphrase(\"mypassword\")\n\n// after\nconfig // passphrase property removed entirely","handlingStrategy":"validation","validationCode":"boolean encrypted = pem.contains(\"BEGIN ENCRYPTED PRIVATE KEY\");\nif (!encrypted && passphrase != null && !passphrase.isEmpty()) {\n  throw new IllegalStateException(\"Passphrase set but key is unencrypted\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep config schemas so the passphrase field is optional and cleared for unencrypted keys.","Check the PEM header when generating config.","Avoid templated configs that always ship a passphrase value."],"tags":["snowflake","private-key","authentication","configuration"],"backgroundTag":"conflicting-config-options","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}