{"record":{"id":"9b2df0156c59684a","repo":"spring-projects/spring-security","slug":"string-is-not-pem-encoded-data-nor-a-public-key-e","errorCode":null,"errorMessage":"String is not PEM encoded data, nor a public key encoded for ssh","messagePattern":"String is not PEM encoded data, nor a public key encoded for ssh","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java","lineNumber":83,"sourceCode":"\tprivate static final byte[] PREFIX = new byte[] { 0, 0, 0, 7, 's', 's', 'h', '-', 'r', 's', 'a' };\n\n\tprivate RsaKeyHelper() {\n\t}\n\n\tstatic KeyPair parseKeyPair(String pemData) {\n\t\tMatcher m = PEM_DATA.matcher(pemData.replaceAll(\"\\n *\", \"\").trim());\n\n\t\tif (!m.matches()) {\n\t\t\ttry {\n\t\t\t\tRSAPublicKey publicValue = extractPublicKey(pemData);\n\t\t\t\tif (publicValue != null) {\n\t\t\t\t\treturn new KeyPair(publicValue, null);\n\t\t\t\t}\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\t// Ignore\n\t\t\t}\n\t\t\tthrow new IllegalArgumentException(\"String is not PEM encoded data, nor a public key encoded for ssh\");\n\t\t}\n\n\t\tString type = m.group(1);\n\t\tfinal byte[] content = base64Decode(m.group(2));\n\n\t\tPublicKey publicKey;\n\t\tPrivateKey privateKey = null;\n\n\t\ttry {\n\t\t\tKeyFactory fact = KeyFactory.getInstance(\"RSA\");\n\t\t\tswitch (type) {\n\t\t\t\tcase \"RSA PRIVATE KEY\" -> {\n\t\t\t\t\tASN1Sequence seq = ASN1Sequence.getInstance(content);\n\t\t\t\t\tif (seq.size() != 9) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(\"Invalid RSA Private Key ASN1 sequence.\");\n\t\t\t\t\t}\n\t\t\t\t\torg.bouncycastle.asn1.pkcs.RSAPrivateKey key = org.bouncycastle.asn1.pkcs.RSAPrivateKey\n\t\t\t\t\t\t.getInstance(seq);","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java#L65-L101","documentation":"RsaKeyHelper.parseKeyPair() first tries to interpret the input string as PEM data or an SSH public key; if both attempts fail (or the string matched nothing) it throws this IllegalArgumentException. It means the supplied string is neither PEM-encoded key material nor an ssh-rsa encoded public key.","triggerScenarios":"Passing a raw modulus/hex string, a base64 blob without PEM headers, an empty or whitespace-only string, or a wrongly formatted PEM (missing BEGIN/END lines) into parseKeyPair().","commonSituations":"Copying a key from a terminal losing the BEGIN/END header lines; pasting an OpenSSH-format key (ssh-ed25519 or new OpenSSH private key format) that the ssh-rsa regex does not match; reading the key file with wrong encoding (UTF-16); accidentally passing a certificate instead of a key.","solutions":["Ensure the string is proper PEM with header/footer, e.g. -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----","Convert OpenSSH-format keys to PEM: ssh-keygen -p -m PEM -f id_rsa","Strip whitespace/BOM and re-save the key file as UTF-8/ASCII","Confirm you are passing the key, not an X.509 certificate; extract the key from the cert if needed"],"exampleFix":"// before\nKeyPair kp = RsaKeyHelper.parseKeyPair(\"MIICdgIBADANBg...\"); // raw base64, no PEM\n// after\nKeyPair kp = RsaKeyHelper.parseKeyPair(\n    \"-----BEGIN RSA PRIVATE KEY-----\\nMIICdgIBADANBg...\\n-----END RSA PRIVATE KEY-----\");","handlingStrategy":"validation","validationCode":"boolean isPem(String s) {\n    return s != null && s.contains(\"-----BEGIN\") && s.contains(\"-----END\");\n}\nif (!isPem(keyString)) throw new IllegalArgumentException(\"Key must be PEM encoded\");","typeGuard":"static boolean isPemEncoded(String s) {\n    return s != null && s.trim().startsWith(\"-----BEGIN\") && s.trim().contains(\"-----END\");\n}","tryCatchPattern":"try { return RsaKeyHelper.parseKeyPair(pem); } catch (IllegalArgumentException ex) { throw new BadConfigurationException(\"Key material must be PEM or ssh-rsa encoded\", ex); }","preventionTips":["Convert OpenSSH keys to PEM with ssh-keygen -m PEM","Always copy keys including BEGIN/END header lines","Read key files as UTF-8/ASCII text","Validate the header type matches RSA before parsing"],"tags":["pem","rsa","ssh","invalid-input"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}