{"record":{"id":"67bebb3aeddf795f","repo":"slackhq/nebula","slug":"errinvalidpemed25519privatekeybanner","errorCode":"ErrInvalidPEMEd25519PrivateKeyBanner","errorMessage":"bytes did not contain a proper Ed25519 private key banner","messagePattern":"bytes did not contain a proper Ed25519 private key banner","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":32,"sourceCode":"\tErrBlockListed                = errors.New(\"certificate is in the block list\")\n\tErrFingerprintMismatch        = errors.New(\"certificate fingerprint did not match\")\n\tErrSignatureMismatch          = errors.New(\"certificate signature did not match\")\n\tErrInvalidPublicKey           = errors.New(\"invalid public key\")\n\tErrInvalidPrivateKey          = errors.New(\"invalid private key\")\n\tErrPublicPrivateCurveMismatch = errors.New(\"public key does not match private key curve\")\n\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")\n\tErrInvalidPEMCertificateBanner       = errors.New(\"bytes did not contain a proper certificate banner\")\n\tErrInvalidPEMX25519PublicKeyBanner   = errors.New(\"bytes did not contain a proper X25519 public key banner\")\n\tErrInvalidPEMX25519PrivateKeyBanner  = errors.New(\"bytes did not contain a proper X25519 private key banner\")\n\tErrInvalidPEMEd25519PublicKeyBanner  = errors.New(\"bytes did not contain a proper Ed25519 public key banner\")\n\tErrInvalidPEMEd25519PrivateKeyBanner = errors.New(\"bytes did not contain a proper Ed25519 private key banner\")\n\n\tErrNoPeerStaticKey = errors.New(\"no peer static key was present\")\n\tErrNoPayload       = errors.New(\"provided payload was empty\")\n\n\tErrMissingDetails  = errors.New(\"certificate did not contain details\")\n\tErrEmptySignature  = errors.New(\"empty signature\")\n\tErrEmptyRawDetails = errors.New(\"empty rawDetails not allowed\")\n)\n\ntype ErrInvalidCertificateProperties struct {\n\tstr string\n}\n\nfunc NewErrInvalidCertificateProperties(format string, a ...any) error {\n\treturn &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}\n}\n\nfunc (e *ErrInvalidCertificateProperties) Error() string {","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L14-L50","documentation":"ErrInvalidPEMEd25519PrivateKeyBanner is thrown when PEM bytes expected to contain an Ed25519 private key lack the proper Ed25519 PRIVATE KEY banner. The library validates the PEM block type before decoding, so any other key type or a malformed block is rejected.","triggerScenarios":"Passing bytes with a wrong or missing PEM banner to an Ed25519 private key parser — e.g. an X25519 private key, a public key, or a non-PEM blob.","commonSituations":"Secret mounted from the wrong file in Kubernetes/container environments; key regenerated as X25519 after a curve migration; newline/base64 corruption during copy-paste into env vars.","solutions":["Check that the key file starts with the proper Ed25519 private key BEGIN banner","Fix the secret/path so the Ed25519 private key (not a public key or other curve's key) is loaded","Re-generate or re-export the signing key as Ed25519 if the algorithm changed"],"exampleFix":"// before\nkeyBytes, _ := os.ReadFile(\"x25519.key\")\n// after\nkeyBytes, _ := os.ReadFile(\"ed25519.key\") // proper Ed25519 PRIVATE KEY banner","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(keyBytes)\nif block == nil || !strings.Contains(block.Type, \"ED25519 PRIVATE KEY\") {\n    return fmt.Errorf(\"not an Ed25519 private key PEM\")\n}","typeGuard":"func isEd25519PrivateKeyPEM(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    return blk != nil && strings.Contains(blk.Type, \"ED25519 PRIVATE KEY\")\n}","tryCatchPattern":"key, err := loadEd25519PrivKey(keyBytes)\nif errors.Is(err, cert.ErrInvalidPEMEd25519PrivateKeyBanner) {\n    // wrong key type mounted: fix secret/source\n}","preventionTips":["Verify secret mounts point to the Ed25519 private key file in container environments","Run a startup self-check that parses all configured keys and fails fast","Regenerate keys with the intended algorithm rather than renaming cross-curve files"],"tags":["pem","ed25519","key-parsing","config"],"backgroundTag":"invalid-pem-banner","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}