{"record":{"id":"9544ecbc40be5c5b","repo":"caddyserver/caddy","slug":"private-key-type-t-does-not-match-issuer-public-k","errorCode":null,"errorMessage":"private key type %T does not match issuer public key type %T","messagePattern":"private key type %T does not match issuer public key type %T","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/crypto.go","lineNumber":132,"sourceCode":"\t\t\t\treturn nil, nil, err\n\t\t\t}\n\t\t}\n\n\t\treturn chain, key, nil\n\n\tdefault:\n\t\treturn nil, nil, fmt.Errorf(\"unsupported format: %s\", kp.Format)\n\t}\n}\n\n// verifyKeysMatch verifies that the public key in the [x509.Certificate] matches\n// the public key of the [crypto.Signer].\nfunc verifyKeysMatch(crt *x509.Certificate, signer crypto.Signer) error {\n\tswitch pub := crt.PublicKey.(type) {\n\tcase *rsa.PublicKey:\n\t\tpk, ok := signer.Public().(*rsa.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tcase *ecdsa.PublicKey:\n\t\tpk, ok := signer.Public().(*ecdsa.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tcase ed25519.PublicKey:\n\t\tpk, ok := signer.Public().(ed25519.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/crypto.go#L114-L150","documentation":"Error \"private key type %T does not match issuer public key type %T\" thrown in caddyserver/caddy.","triggerScenarios":"Thrown at modules/caddypki/crypto.go:132 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a private key whose algorithm matches the issuer's public key algorithm (e.g. both ECDSA or both RSA)."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}