{"record":{"id":"88408da2736c12c0","repo":"slackhq/nebula","slug":"bytes-did-not-contain-a-proper-ed25519-ecdsa-priva","errorCode":null,"errorMessage":"bytes did not contain a proper Ed25519/ECDSA private key banner","messagePattern":"bytes did not contain a proper Ed25519/ECDSA private key banner","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/pem.go","lineNumber":274,"sourceCode":"\t}\n\tvar curve Curve\n\tswitch k.Type {\n\tcase EncryptedEd25519PrivateKeyBanner:\n\t\treturn nil, nil, Curve_CURVE25519, ErrPrivateKeyEncrypted\n\tcase EncryptedECDSAP256PrivateKeyBanner:\n\t\treturn nil, nil, Curve_P256, ErrPrivateKeyEncrypted\n\tcase Ed25519PrivateKeyBanner:\n\t\tcurve = Curve_CURVE25519\n\t\tif len(k.Bytes) != ed25519.PrivateKeySize {\n\t\t\treturn nil, r, 0, fmt.Errorf(\"key was not %d bytes, is invalid Ed25519 private key\", ed25519.PrivateKeySize)\n\t\t}\n\tcase ECDSAP256PrivateKeyBanner:\n\t\tcurve = Curve_P256\n\t\tif len(k.Bytes) != 32 {\n\t\t\treturn nil, r, 0, fmt.Errorf(\"key was not 32 bytes, is invalid ECDSA P256 private key\")\n\t\t}\n\tdefault:\n\t\treturn nil, r, 0, fmt.Errorf(\"bytes did not contain a proper Ed25519/ECDSA private key banner\")\n\t}\n\treturn k.Bytes, r, curve, nil\n}\n","sourceCodeStart":256,"sourceCodeEnd":278,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/pem.go#L256-L278","documentation":"pem.Decode produced a block, but its Type matches none of the accepted signing private key banners: encrypted Ed25519, encrypted ECDSA P256, plain Ed25519, or plain ECDSA P256. The input is valid PEM but is not a nebula signing private key — commonly it is a host (X25519/P256) key, a public key, or a certificate.","triggerScenarios":"Call UnmarshalSigningPrivateKeyFromPEM with any PEM block whose k.Type is not one of EncryptedEd25519PrivateKeyBanner, EncryptedECDSAP256PrivateKeyBanner, Ed25519PrivateKeyBanner, ECDSAP256PrivateKeyBanner.","commonSituations":"Swapping signing_key_path with key/cert paths in nebula config, passing an openssl-generated 'EC PRIVATE KEY' or 'PRIVATE KEY' block, or feeding a certificate PEM to the key parser.","solutions":["Use the CA signing key file (banner 'NEBULA ED25519 SIGNING PRIVATE KEY' or 'NEBULA ECDSA P256 SIGNING PRIVATE KEY')","Regenerate with nebula-cert ca / keygen to get a correctly bannered signing key","Double-check config: signing_key_path must not point at the host key or certificate"],"exampleFix":"// before\nsigning_key_path: ./host.key // X25519 host key\n// after\nsigning_key_path: ./ca.key // Ed25519/ECDSA P256 signing private key banner","handlingStrategy":"validation","validationCode":"blk, _ := pem.Decode(data)\nvalid := map[string]bool{\n    \"NEBULA ED25519 SIGNING PRIVATE KEY\": true,\n    \"NEBULA ECDSA P256 SIGNING PRIVATE KEY\": true,\n    \"NEBULA ED25519 ENCRYPTED SIGNING PRIVATE KEY\": true,\n    \"NEBULA ECDSA P256 ENCRYPTED SIGNING PRIVATE KEY\": true,\n}\nif blk != nil && !valid[blk.Type] {\n    return fmt.Errorf(\"not a nebula signing private key, PEM type is %q\", blk.Type)\n}","typeGuard":"func isSigningPrivateKey(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    if blk == nil { return false }\n    switch blk.Type {\n    case \"NEBULA ED25519 SIGNING PRIVATE KEY\", \"NEBULA ECDSA P256 SIGNING PRIVATE KEY\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"key, _, curve, err := nebula.UnmarshalSigningPrivateKeyFromPEM(raw)\nif err != nil {\n    return fmt.Errorf(\"%s is not a signing private key — check signing_key_path: %w\", path, err)\n}","preventionTips":["Label key files explicitly (ca-signing.key vs host.key) and never swap them","Validate all key PEM banners once during config load","Generate signing keys only via nebula-cert ca"],"tags":["pem","signing-key","key-banner","wrong-key-type"],"backgroundTag":"unrecognized-pem-key-type","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}