{"record":{"id":"62ea57b9dd1b355a","repo":"t8y2/dbx","slug":"unsupported-private-key-format-in-keypath-use","errorCode":null,"errorMessage":"Unsupported private key format in ${keyPath}. Use PKCS#8 (-----BEGIN PRIVATE KEY-----) or PKCS#1 RSA (-----BEGIN RSA PRIVATE KEY-----).","messagePattern":"Unsupported private key format in (.+?)\\. Use PKCS#8 \\(-----BEGIN PRIVATE KEY-----\\) or PKCS#1 RSA \\(-----BEGIN RSA PRIVATE KEY-----\\)\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java","lineNumber":286,"sourceCode":"            int octetLen = keyBytes.length;\n            byte[] octetLenBytes;\n            if (octetLen < 128) {\n                octetLenBytes = new byte[] {(byte) octetLen};\n            } else if (octetLen < 256) {\n                octetLenBytes = new byte[] {(byte) 0x81, (byte) octetLen};\n            } else {\n                octetLenBytes = new byte[] {(byte) 0x82, (byte) (octetLen >> 8), (byte) (octetLen & 0xff)};\n            }\n            byte[] pkcs8Key = new byte[pkcs8Header.length + octetLenBytes.length - 1 + keyBytes.length];\n            int pos = 0;\n            System.arraycopy(pkcs8Header, 0, pkcs8Key, pos, pkcs8Header.length - 1);  // exclude placeholder OCTET STRING length\n            pos += pkcs8Header.length - 1;\n            System.arraycopy(octetLenBytes, 0, pkcs8Key, pos, octetLenBytes.length);\n            pos += octetLenBytes.length;\n            System.arraycopy(keyBytes, 0, pkcs8Key, pos, keyBytes.length);\n            return KeyFactory.getInstance(\"RSA\").generatePrivate(new PKCS8EncodedKeySpec(pkcs8Key));\n        } catch (Exception e) {\n            throw new IllegalArgumentException(\n                \"Unsupported private key format in \" + keyPath\n                    + \". Use PKCS#8 (-----BEGIN PRIVATE KEY-----) or PKCS#1 RSA (-----BEGIN RSA PRIVATE KEY-----).\",\n                e);\n        }\n    }\n\n    static String firstNonBlank(String... values) {\n        for (String value : values) {\n            if (value != null && !value.isBlank()) {\n                return value;\n            }\n        }\n        return null;\n    }\n\n    static String authenticationDatabase(JsonObject connObj) {\n        String authSource = urlParam(stringOrNull(connObj, \"url_params\"), \"authSource\");\n        if (authSource != null && !authSource.isBlank()) {","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java#L268-L304","documentation":"Thrown by MongoAgent.loadPrivateKeyFromPem when the PEM file at keyPath has a header the parser does not recognize — only 'BEGIN PRIVATE KEY' (PKCS#8) and 'BEGIN RSA PRIVATE KEY' (PKCS#1) are supported. Commonly hit with PKCS#1 EC keys, encrypted keys, or openssh-format keys; X.509 mTLS client auth cannot proceed.","triggerScenarios":"Thrown at agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java:286 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Convert the key to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem","For RSA keys in another format convert to PKCS#1: openssl rsa -in key.pem -out key-rsa.pem","Remove PEM encryption (openssl rsa -in key.pem -out key-plain.pem) since encrypted PEM is not supported","Confirm the file actually contains a private key block and you passed the key path, not the certificate path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}