{"record":{"id":"724b83caf733a07f","repo":"rancher/rancher","slug":"saml-error-parsing-pkcs1-rsa-key-v","errorCode":null,"errorMessage":"SAML: error parsing PKCS1 RSA key: %v","messagePattern":"SAML: error parsing PKCS1 RSA key: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/saml/saml_client.go","lineNumber":118,"sourceCode":"\t}\n\n\tif configToSet.SpKey != \"\" {\n\t\t// used from ssh.ParseRawPrivateKey\n\n\t\tblock, _ := pem.Decode([]byte(configToSet.SpKey))\n\t\tif block == nil {\n\t\t\treturn fmt.Errorf(\"SAML: no key found\")\n\t\t}\n\n\t\tif strings.Contains(block.Headers[\"Proc-Type\"], \"ENCRYPTED\") {\n\t\t\treturn fmt.Errorf(\"SAML: cannot decode encrypted private keys\")\n\t\t}\n\n\t\tswitch block.Type {\n\t\tcase \"RSA PRIVATE KEY\":\n\t\t\tprivKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"SAML: error parsing PKCS1 RSA key: %v\", err)\n\t\t\t}\n\t\tcase \"PRIVATE KEY\":\n\t\t\tpk, err := x509.ParsePKCS8PrivateKey(block.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"SAML: error parsing PKCS8 RSA key: %v\", err)\n\t\t\t}\n\t\t\tprivKey, ok = pk.(*rsa.PrivateKey)\n\t\t\tif !ok {\n\t\t\t\treturn fmt.Errorf(\"SAML: unable to get rsa key\")\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"SAML: unsupported key type %q\", block.Type)\n\t\t}\n\t}\n\n\tif configToSet.SpCert != \"\" {\n\t\tblock, _ := pem.Decode([]byte(configToSet.SpCert))\n\t\tif block == nil {","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/saml/saml_client.go#L100-L136","documentation":"The PEM block type is RSA PRIVATE KEY (PKCS#1) but x509.ParsePKCS1PrivateKey rejected its bytes, so the body is not a valid PKCS#1 RSA structure. The framing was right; the payload is truncated, corrupted, or actually a different encoding mislabeled with an RSA header.","triggerScenarios":"Pasting a PKCS#1 header over PKCS#8/EC body, truncating the base64 body on copy, or a YAML/template step that dropped characters or mangled padding.","commonSituations":"Hand-edited PEM files; clipboard truncation of long keys; scripts that concatenate header + wrong payload; line-length rewrapping that deletes characters.","solutions":["Re-export the key cleanly from the source: openssl rsa -in key.pem -check -out checked.pem to validate, then use checked.pem.","If the material is actually PKCS#8, keep its own header (-----BEGIN PRIVATE KEY-----) instead of an RSA PRIVATE KEY header.","Diff the stored secret against the original file byte-for-byte (compare fingerprints: openssl pkey -in key.pem -pubout | sha256sum)."],"exampleFix":"# before: PKCS#8 body with a PKCS#1 header (parse fails)\n-----BEGIN RSA PRIVATE KEY-----\nMIIB...PKCS8DATA...\n-----END RSA PRIVATE KEY-----\n\n# after: correct header for the body\n-----BEGIN PRIVATE KEY-----\nMIIB...PKCS8DATA...\n-----END PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode([]byte(spKey))\nif block != nil && block.Type == \"RSA PRIVATE KEY\" {\n    if _, err := x509.ParsePKCS1PrivateKey(block.Bytes); err != nil {\n        return fmt.Errorf(\"spKey fails PKCS#1 parse (%v); key body corrupted or wrong format\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := samlClient.InitializeSamlServiceProvider(cfg, name); err != nil {\n    if strings.Contains(err.Error(), \"error parsing PKCS1\") {\n        return fmt.Errorf(\"spKey PEM header does not match its body; re-export the key and retry\")\n    }\n    return err\n}","preventionTips":["Verify keys locally with openssl rsa -in key.pem -check -noout before configuring.","Never hand-edit PEM headers or bodies.","Compare fingerprints between source key and stored secret to catch pipeline corruption."],"tags":["go","saml","pem","pkcs1","private-key"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}