{"record":{"id":"77e13681a15cfff5","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-activate-private-key-no-such-private-key-w","errorCode":null,"errorMessage":"Cannot activate private key: no such private key was found.","messagePattern":"Cannot activate private key: no such private key was found\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimaryZone.cs","lineNumber":1228,"sourceCode":"                    dnsKeyTags = privateKey.KeyTag.ToString();\n                else\n                    dnsKeyTags += \", \" + privateKey.KeyTag.ToString();\n            }\n\n            _dnsServer.LogManager.Write(\"The ZSK DNSKEYs (\" + dnsKeyTags + \") from the primary zone were activated successfully: \" + ToString());\n        }\n\n        public void ActivateKskDnsKey(ushort keyTag)\n        {\n            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)\n                throw new DnsServerException(\"The zone must be signed.\");\n\n            DnssecPrivateKey privateKey;\n\n            lock (_dnssecPrivateKeys)\n            {\n                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out privateKey))\n                    throw new DnsServerException(\"Cannot activate private key: no such private key was found.\");\n            }\n\n            if (privateKey.KeyType != DnssecPrivateKeyType.KeySigningKey)\n                throw new DnsServerException(\"Cannot activate private key: only a Key Signing Key (KSK) can be activated.\");\n\n            if (privateKey.State != DnssecPrivateKeyState.Ready)\n                throw new DnsServerException(\"Cannot activate private key: the Key Signing Key (KSK) must be in 'Ready' state.\");\n\n            if (privateKey.IsRetiring)\n                throw new DnsServerException(\"Cannot activate private key: the Key Signing Key (KSK) is already set to retire.\");\n\n            privateKey.SetState(DnssecPrivateKeyState.Active);\n        }\n\n        public void RolloverDnsKey(ushort keyTag)\n        {\n            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)\n                throw new DnsServerException(\"The zone must be signed.\");","sourceCodeStart":1210,"sourceCodeEnd":1246,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimaryZone.cs#L1210-L1246","documentation":"Thrown by ActivateKskDnsKey when _dnssecPrivateKeys.TryGetValue fails for the supplied keyTag. You can only activate a KSK that the zone actually holds.","triggerScenarios":"Calling ActivateKskDnsKey with a keyTag not present in the zone's private key set.","commonSituations":"Passing a keyTag from a different zone, a stale tag, or 0 due to an uninitialised variable.","solutions":["Confirm the keyTag exists in zone.DnssecPrivateKeys before activating.","Ensure the target key's KeyType is KeySigningKey and its State is Ready before calling.","Refresh the key listing and use the tag returned by GenerateAndAddPrivateKey or AddPrivateKey."],"exampleFix":"// before\nzone.ActivateKskDnsKey(keyTag);\n\n// after\nvar key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);\nif (key is null)\n    throw new ArgumentException($\"No private key with KeyTag {keyTag}.\");\nif (key.KeyType != DnssecPrivateKeyType.KeySigningKey)\n    throw new ArgumentException($\"Key {keyTag} is not a KSK.\");\nzone.ActivateKskDnsKey(keyTag);","handlingStrategy":"validation","validationCode":"// Verify the keyTag exists and is a KSK before activating\nvar key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);\nif (key is null)\n    throw new ArgumentException($\"No private key with KeyTag {keyTag}.\");\nif (key.KeyType != DnssecPrivateKeyType.KeySigningKey)\n    throw new ArgumentException($\"Key {keyTag} is not a KSK.\");\nzone.ActivateKskDnsKey(keyTag);","typeGuard":"static bool IsActivatableKsk(DnssecPrivateKey key) =>\n    key.KeyType == DnssecPrivateKeyType.KeySigningKey\n    && key.State == DnssecPrivateKeyState.Ready\n    && !key.IsRetiring;","tryCatchPattern":"try\n{\n    zone.ActivateKskDnsKey(keyTag);\n}\ncatch (DnsServerException ex) when (ex.Message.Contains(\"no such private key was found\"))\n{\n    // refresh the key list; the tag is stale or from another zone\n}","preventionTips":["Use the KeyTag returned by GenerateAndAddPrivateKey, not a hardcoded value.","Validate KeyType and State before calling ActivateKskDnsKey."],"tags":["dnssec","private-key","ksk","validation","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}