{"record":{"id":"58bd12f10113ee32","repo":"hashicorp/terraform","slug":"failed-to-parse-private-key-q-s","errorCode":null,"errorMessage":"failed to parse private key %q: %s","messagePattern":"failed to parse private key %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/provisioner.go","lineNumber":400,"sourceCode":"\n\tif opts.password != \"\" {\n\t\tconf.Auth = append(conf.Auth, ssh.Password(opts.password))\n\t\tconf.Auth = append(conf.Auth, ssh.KeyboardInteractive(\n\t\t\tPasswordKeyboardInteractive(opts.password)))\n\t}\n\n\tif opts.sshAgent != nil {\n\t\tconf.Auth = append(conf.Auth, opts.sshAgent.Auth())\n\t}\n\n\treturn conf, nil\n}\n\n// Create a Cert Signer and return ssh.AuthMethod\nfunc signCertWithPrivateKey(pk string, certificate string) (ssh.AuthMethod, error) {\n\trawPk, err := ssh.ParseRawPrivateKey([]byte(pk))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse private key %q: %s\", pk, err)\n\t}\n\n\tpcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certificate))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate %q: %s\", certificate, err)\n\t}\n\n\tusigner, err := ssh.NewSignerFromKey(rawPk)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create signer from raw private key %q: %s\", rawPk, err)\n\t}\n\n\tucertSigner, err := ssh.NewCertSigner(pcert.(*ssh.Certificate), usigner)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create cert signer %q: %s\", usigner, err)\n\t}\n\n\treturn ssh.PublicKeys(ucertSigner), nil","sourceCodeStart":382,"sourceCodeEnd":418,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/provisioner.go#L382-L418","documentation":"Raised in signCertWithPrivateKey when ssh.ParseRawPrivateKey fails parsing the private key string used for certificate-based SSH authentication. This occurs when both private_key and certificate are configured (the cert-signer code path). The raw private key must be parseable by Go's x/crypto/ssh for the cert signer to be built.","triggerScenarios":"The private_key value is not valid PEM, uses an unsupported key format, is truncated/corrupted, or is passphrase-encrypted (ParseRawPrivateKey does not handle encrypted keys in this path).","commonSituations":"The private_key file content was read incorrectly (e.g. file() path wrong), the key is in a format Go's SSH library does not support, the key was copy-pasted with missing lines or trailing whitespace, or the key is OpenSSH encrypted.","solutions":["Verify the private_key value is a complete, valid PEM private key (check with ssh-keygen -l -f keyfile).","Ensure the key is not passphrase-encrypted; decrypt it first if it is (ssh-keygen -p).","Confirm the key format is supported (RSA, ECDSA, Ed25519 in PEM/OpenSSH format).","Check the file() path or variable interpolation that supplies the key content."],"exampleFix":"// before\nconnection {\n  private_key = \"-----BEGIN OPENSSH PRIVATE KEY-----\\n...truncated...\"\n  certificate = var.cert\n}\n\n// after\nconnection {\n  private_key = file(\"~/.ssh/id_ed25519\")\n  certificate = file(\"~/.ssh/id_ed25519-cert.pub\")\n}","handlingStrategy":"validation","validationCode":"// Validate the private key is parseable before constructing the communicator\nfunc validatePrivateKey(pk string) error {\n    block, _ := pem.Decode([]byte(pk))\n    if block == nil {\n        return errors.New(\"private key is not valid PEM\")\n    }\n    if block.Headers[\"Proc-Type\"] == \"4,ENCRYPTED\" {\n        return errors.New(\"private key is encrypted — decrypt it before use\")\n    }\n    if _, err := ssh.ParseRawPrivateKey([]byte(pk)); err != nil {\n        return fmt.Errorf(\"failed to parse private key: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use file() to read the key content to avoid truncation from copy-paste.","Decrypt passphrase-protected keys with ssh-keygen -p before use.","Use standard key types: RSA, ECDSA, or Ed25519 in PEM/OpenSSH format."],"tags":["ssh","private-key","certificate","authentication","pem","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}