{"record":{"id":"94b7fb8b3185f0d7","repo":"caddyserver/caddy","slug":"encrypted-private-keys-are-not-supported-please-d-94b7fb","errorCode":null,"errorMessage":"encrypted private keys are not supported; please decrypt the key first","messagePattern":"encrypted private keys are not supported; please decrypt the key first","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/storageloader.go","lineNumber":97,"sourceCode":"\t\tcertData, err := sl.storage.Load(sl.ctx, pair.Certificate)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tkeyData, err := sl.storage.Load(sl.ctx, pair.Key)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tvar cert tls.Certificate\n\t\tswitch pair.Format {\n\t\tcase \"\":\n\t\t\tfallthrough\n\n\t\tcase \"pem\":\n\t\t\t// if the start of the key file looks like an encrypted private key,\n\t\t\t// reject it with a helpful error message\n\t\t\tif strings.Contains(string(keyData[:40]), \"ENCRYPTED\") {\n\t\t\t\treturn nil, fmt.Errorf(\"encrypted private keys are not supported; please decrypt the key first\")\n\t\t\t}\n\n\t\t\tcert, err = tls.X509KeyPair(certData, keyData)\n\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unrecognized certificate/key encoding format: %s\", pair.Format)\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tcerts = append(certs, Certificate{Certificate: cert, Tags: pair.Tags})\n\t}\n\treturn certs, nil\n}\n\n// Interface guard\nvar (","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/storageloader.go#L79-L115","documentation":"Error \"encrypted private keys are not supported; please decrypt the key first\" thrown in caddyserver/caddy.","triggerScenarios":"Thrown at modules/caddytls/storageloader.go:97 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Decrypt the private key first, e.g. with 'openssl rsa -in key.pem -out key-decrypted.pem', then store the decrypted key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}