{"record":{"id":"8d63ad81d24ce608","repo":"dgraph-io/dgraph","slug":"unknown-pem-type-s","errorCode":null,"errorMessage":"Unknown PEM type: %s","messagePattern":"Unknown PEM type: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/create.go","lineNumber":111,"sourceCode":"\n// readKey tries to read and decode the contents of a private key file.\n// Returns the private key, or error otherwise.\nfunc readKey(keyFile string) (crypto.PrivateKey, error) {\n\tb, err := os.ReadFile(keyFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, _ := pem.Decode(b)\n\tswitch {\n\tcase block == nil:\n\t\treturn nil, errors.Errorf(\"Failed to read key block\")\n\tcase block.Type == \"EC PRIVATE KEY\":\n\t\treturn x509.ParseECPrivateKey(block.Bytes)\n\tcase block.Type == \"RSA PRIVATE KEY\":\n\t\treturn x509.ParsePKCS1PrivateKey(block.Bytes)\n\t}\n\treturn nil, errors.Errorf(\"Unknown PEM type: %s\", block.Type)\n}\n\n// readCert tries to read and decode the contents of a signed cert file.\n// Returns the x509v3 cert, or error otherwise.\nfunc readCert(certFile string) (*x509.Certificate, error) {\n\tb, err := os.ReadFile(certFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, _ := pem.Decode(b)\n\tswitch {\n\tcase block == nil:\n\t\treturn nil, errors.Errorf(\"Failed to read cert block\")\n\tcase block.Type != \"CERTIFICATE\":\n\t\treturn nil, errors.Errorf(\"Unknown PEM type: %s\", block.Type)\n\t}\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/create.go#L93-L129","documentation":"readKey (dgraph/cmd/cert/create.go:111) fails when the file is valid PEM but its block Type is neither \"EC PRIVATE KEY\" nor \"RSA PRIVATE KEY\". The tool only supports those two PEM labels for private keys, so anything else (e.g. \"PRIVATE KEY\" PKCS#8, \"ENCRYPTED PRIVATE KEY\", \"CERTIFICATE\") is rejected.","triggerScenarios":"readKey is given a key file whose PEM header doesn't match: a PKCS#8 key (BEGIN PRIVATE KEY), an encrypted key (BEGIN ENCRYPTED PRIVATE KEY), or accidentally a certificate file (BEGIN CERTIFICATE).","commonSituations":"Importing keys generated by openssl/newer tooling that defaults to PKCS#8 format; pointing the key path at a cert; using password-protected keys; keys converted by other tools with different PEM labels.","solutions":["Check the PEM header (`head -1 <keyfile>`); confirm it says EC PRIVATE KEY or RSA PRIVATE KEY.","Convert PKCS#8 to traditional PEM: `openssl rsa -in key.pem -out key.trad.pem` (or `openssl ec` for EC keys).","Decrypt encrypted keys first: `openssl rsa -in encrypted.pem -out unencrypted.pem` and remove the passphrase.","If the path points at a certificate, fix the path to the .key file."],"exampleFix":"// before: PKCS#8 key not accepted\n// file starts with: -----BEGIN PRIVATE KEY-----\n// after: convert to traditional PEM first\n// $ openssl rsa -in key.pem -out key.trad.pem  → -----BEGIN RSA PRIVATE KEY-----","handlingStrategy":"type-guard","validationCode":"b, _ := os.ReadFile(keyFile)\nblock, _ := pem.Decode(b)\nif block != nil && block.Type != \"EC PRIVATE KEY\" && block.Type != \"RSA PRIVATE KEY\" {\n    return fmt.Errorf(\"key %s has PEM type %q; convert to traditional RSA/EC PEM first\", keyFile, block.Type)\n}","typeGuard":"func isSupportedPEMKeyType(data []byte) bool {\n    block, _ := pem.Decode(data)\n    return block != nil &&\n        (block.Type == \"EC PRIVATE KEY\" || block.Type == \"RSA PRIVATE KEY\")\n}","tryCatchPattern":"key, err := readKey(keyFile)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"Unknown PEM type\") {\n        return fmt.Errorf(\"convert the key to traditional PEM (openssl rsa / openssl ec): %w\", err)\n    }\n    return err\n}","preventionTips":["Inspect the PEM header (`head -1 key.pem`) and reject PKCS#8 ('BEGIN PRIVATE KEY') or encrypted keys upfront.","Convert openssl defaults to traditional PEM before feeding the tool: `openssl rsa -in k.pem -out trad.pem`.","Keep cert and key files in separate, clearly named files to avoid path mix-ups.","Strip passphrases from keys used by the server, or use a loader that supports encryption."],"tags":["pem","tls","key-format","pkcs8"],"backgroundTag":"unsupported-pem-key-format","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}