{"record":{"id":"6be6a4affe2ef5ee","repo":"juicedata/juicefs","slug":"parse-private-key-s","errorCode":null,"errorMessage":"parse private key: %s","messagePattern":"parse private key: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/format.go","lineNumber":295,"sourceCode":"\t}\n\n\tif format.Shards > 1 {\n\t\tblob, err = object.NewSharded(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken, format.Shards)\n\t} else {\n\t\tblob, err = object.CreateStorage(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken)\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tblob = object.WithPrefix(blob, format.Name+\"/\")\n\tinitStorageTiers(blob, format.Tiers)\n\tif format.EncryptKey != \"\" {\n\t\tprivKey, err := object.ParsePrivateKeyFromPem([]byte(format.EncryptKey), []byte(os.Getenv(\"JFS_RSA_PASSPHRASE\")))\n\t\tif err != nil {\n\t\t\tif errors.Is(err, object.ErrKeyNeedPasswd) {\n\t\t\t\treturn nil, fmt.Errorf(\"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable\", err)\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"parse private key: %s\", err)\n\t\t}\n\t\tencryptor, err := object.NewDataEncryptor(object.NewKeyEncryptor(privKey), format.EncryptAlgo)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tblob = object.NewEncrypted(blob, encryptor)\n\t}\n\treturn blob, nil\n}\n\nfunc initStorageTiers(storage object.ObjectStorage, tiers object.Tiers) {\n\tif tierStorage, ok := storage.(object.SupportTier); ok {\n\t\tif err := tierStorage.InitTiers(tiers); err != nil && hasConfiguredTiers(tiers) {\n\t\t\tlogger.Warnf(\"Set storage tier: %s\", err)\n\t\t}\n\t}\n}\n","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L277-L313","documentation":"The RSA private key configured as --encrypt-key could not be parsed. This is the fallback branch when the failure is not 'key needs a passphrase' — the PEM content is malformed, the wrong format, the passphrase is wrong, or decoding fails.","triggerScenarios":"--encrypt-key points to a file that is not a valid PEM private key (a certificate, a public key, corrupted content), or the key is encrypted and the JFS_RSA_PASSPHRASE provided is incorrect, or the key uses an unsupported algorithm/format (e.g. PKCS#1 vs PKCS#8 mismatches handled differently by the parser).","commonSituations":"Typo passing a public key or cert as the encrypt key; wrong passphrase after rotation; key file truncated during copy; generating keys with tools producing formats the Go parser rejects.","solutions":["Validate the key locally: `openssl rsa -in key.pem -check -noout` (or `openssl pkey`)","Confirm you are passing the private key, not the certificate or public key","Verify JFS_RSA_PASSPHRASE matches the passphrase used at key-generation time","Re-export the key in a standard format: `openssl pkcs8 -topk8 -in key.pem -out key8.pem` and retry"],"exampleFix":"// before\n--encrypt-key cert.pem   // a certificate, not a key\n// after\n--encrypt-key private-key.pem  // validated with openssl rsa -check","handlingStrategy":"validation","validationCode":"keyData, err := os.ReadFile(keyPath)\nif err != nil { return err }\nif !bytes.Contains(keyData, []byte(\"-----BEGIN\")) || !bytes.Contains(keyData, []byte(\"PRIVATE KEY-----\")) {\n    return fmt.Errorf(\"%s is not a PEM private key\", keyPath)\n}","typeGuard":"func isPEMPrivateKey(data []byte) bool {\n    block, _ := pem.Decode(data)\n    return block != nil && strings.HasSuffix(block.Type, \"PRIVATE KEY\")\n}","tryCatchPattern":"_, err := createStorage(...)\nif err != nil && strings.HasPrefix(err.Error(), \"parse private key:\") {\n    // key file invalid or wrong passphrase; re-validate with openssl\n}","preventionTips":["Always pass the private key file, never the certificate or public key","Validate keys with `openssl pkey -in key.pem -check -noout` before use","Use a consistent key format (PKCS#8) across environments","Keep the passphrase recorded wherever the key is stored"],"tags":["encryption","rsa","key-format"],"backgroundTag":"invalid-argument-format","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}