{"record":{"id":"6d92d54516b38113","repo":"docker/cli","slug":"no-valid-private-key-found","errorCode":null,"errorMessage":"no valid private key found","messagePattern":"no valid private key found","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/docker/load.go","lineNumber":64,"sourceCode":"\tif ep.TLSData == nil && !ep.SkipTLSVerify {\n\t\t// there is no specific tls config\n\t\treturn nil, nil\n\t}\n\tvar tlsOpts []func(*tls.Config)\n\tif ep.TLSData != nil && ep.TLSData.CA != nil {\n\t\tcertPool := x509.NewCertPool()\n\t\tif !certPool.AppendCertsFromPEM(ep.TLSData.CA) {\n\t\t\treturn nil, errors.New(\"failed to retrieve context tls info: ca.pem seems invalid\")\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.RootCAs = certPool\n\t\t})\n\t}\n\tif ep.TLSData != nil && ep.TLSData.Key != nil && ep.TLSData.Cert != nil {\n\t\tkeyBytes := ep.TLSData.Key\n\t\tpemBlock, _ := pem.Decode(keyBytes)\n\t\tif pemBlock == nil {\n\t\t\treturn nil, errors.New(\"no valid private key found\")\n\t\t}\n\t\tif x509.IsEncryptedPEMBlock(pemBlock) { //nolint:staticcheck // SA1019: x509.IsEncryptedPEMBlock is deprecated, and insecure by design\n\t\t\treturn nil, errors.New(\"private key is encrypted - support for encrypted private keys has been removed, see https://docs.docker.com/go/deprecated/\")\n\t\t}\n\n\t\tx509cert, err := tls.X509KeyPair(ep.TLSData.Cert, keyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to retrieve context tls info: %w\", err)\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.Certificates = []tls.Certificate{x509cert}\n\t\t})\n\t}\n\tif ep.SkipTLSVerify {\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.InsecureSkipVerify = true\n\t\t})\n\t}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/docker/load.go#L46-L82","documentation":"Returned by Endpoint.tlsConfig when pem.Decode on the stored key bytes returns a nil block, meaning the data is not PEM-encoded at all. The key material must be a PEM block (e.g. '-----BEGIN PRIVATE KEY-----') to be usable for a client certificate; non-PEM or empty data is rejected before any key parsing.","triggerScenarios":"A context's key file (key.pem) is empty, contains DER-encoded binary, or holds non-key content. Importing a context archive where the key file is missing/corrupt but the cert is present.","commonSituations":"The key.pem was generated in DER format instead of PEM. The file was truncated during copy. A cert was placed where the key should be.","solutions":["Provide a PEM-encoded private key: convert DER with 'openssl rsa -inform DER -outform PEM -in key.der -out key.pem'.","Verify: 'openssl pkey -in key.pem -noout' should succeed.","Recreate the context using a matching cert/key PEM pair."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if pem.Decode(keyBytes) == nil {\n    return errors.New(\"key file is not PEM-encoded\")\n}","typeGuard":"func isPEMKey(b []byte) bool {\n    block, _ := pem.Decode(b)\n    return block != nil\n}","tryCatchPattern":null,"preventionTips":["Generate keys in PEM format (openssl defaults to PEM).","Convert DER keys with 'openssl rsa -inform DER -outform PEM'.","Verify with 'openssl pkey -in key.pem -noout'."],"tags":["context","tls","private-key","pem","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}