{"record":{"id":"9d51ad05ec43931c","repo":"quarkusio/quarkus","slug":"failure-to-create-a-private-key","errorCode":null,"errorMessage":"Failure to create a private key","messagePattern":"Failure to create a private key","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/letsencrypt/LetsEncryptHelpers.java","lineNumber":270,"sourceCode":"\n    private static X509Certificate getCertificate(String encodedCert) {\n        try {\n            byte[] encodedBytes = Base64.getDecoder().decode(encodedCert);\n            return (X509Certificate) CertificateFactory.getInstance(\"X.509\")\n                    .generateCertificate(new ByteArrayInputStream(encodedBytes));\n        } catch (Exception ex) {\n            throw new RuntimeException(\"Failure to create a certificate\", ex);\n        }\n    }\n\n    private static PrivateKey getPrivateKey(String encodedKey, String keyAlgorithm) {\n        try {\n            KeyFactory f = KeyFactory.getInstance((keyAlgorithm == null || \"RSA\".equals(keyAlgorithm) ? \"RSA\" : \"EC\"));\n            byte[] encodedBytes = Base64.getDecoder().decode(encodedKey);\n            PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(encodedBytes);\n            return f.generatePrivate(spec);\n        } catch (Exception ex) {\n            throw new RuntimeException(\"Failure to create a private key\", ex);\n        }\n    }\n\n    public static void renewCertificate(AcmeClient acmeClient,\n            File letsEncryptPath,\n            boolean staging,\n            String domain,\n            File certChainPemLoc,\n            File privateKeyPemLoc,\n            String acmeServerUrl,\n            String acmeStagingServerUrl) {\n        LOGGER.infof(\"\\uD83D\\uDD35 Renewing %s ACME certificate chain and private key\",\n                (staging ? \"staging\" : \"production\"));\n        issueCertificate(acmeClient, letsEncryptPath, staging, domain, certChainPemLoc, privateKeyPemLoc,\n                acmeServerUrl, acmeStagingServerUrl);\n    }\n\n    public static void deactivateAccount(AcmeClient acmeClient, File letsEncryptPath, boolean staging,","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/letsencrypt/LetsEncryptHelpers.java#L252-L288","documentation":"LetsEncryptHelpers.getPrivateKey() base64-decodes the key material and reconstructs a PrivateKey via KeyFactory with a PKCS8EncodedKeySpec, choosing RSA unless the algorithm is explicitly EC. Any decoding or key-generation failure is wrapped in this RuntimeException. It means the stored ACME account/order private key could not be parsed.","triggerScenarios":"getPrivateKey(encodedKey, keyAlgorithm) throws when the string is not valid base64, the decoded bytes are not a PKCS#8 structure, or the key algorithm mismatch (e.g. an EC key parsed with the RSA KeyFactory, or a non-RSA/non-EC keyAlgorithm passed).","commonSituations":"Key file regenerated by another tool in PKCS#1 ('BEGIN RSA PRIVATE KEY') instead of PKCS#8, key truncated or corrupted on disk, keyAlgorithm config changed to EC while the stored key is RSA.","solutions":["Regenerate the key by deleting the letsencrypt directory and letting the tooling issue a new order/key","Convert PKCS#1 keys to PKCS#8 (openssl pkcs8 -topk8) before storing","Ensure keyAlgorithm matches the actual key ('RSA' or 'EC'); pass null for RSA default","Verify the base64 payload has no PEM headers or whitespace before calling"],"exampleFix":"// before\nPrivateKey key = LetsEncryptHelpers.getPrivateKey(pkcs1KeyBody, \"EC\");\n// after\n// convert to PKCS#8 first: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem\nPrivateKey key = LetsEncryptHelpers.getPrivateKey(pkcs8KeyBody, \"EC\");","handlingStrategy":"validation","validationCode":"static boolean isParseablePkcs8Key(String b64, String alg) {\n    try {\n        byte[] der = Base64.getDecoder().decode(b64.replaceAll(\"-----[A-Z ]+-----|\\\\s\", \"\"));\n        KeyFactory f = KeyFactory.getInstance(alg == null || \"RSA\".equals(alg) ? \"RSA\" : \"EC\");\n        f.generatePrivate(new PKCS8EncodedKeySpec(der));\n        return true;\n    } catch (Exception e) { return false;\n    }\n}","typeGuard":"if (keyAlg != null && !keyAlg.equals(\"RSA\") && !keyAlg.equals(\"EC\")) throw new IllegalArgumentException(\"Unsupported keyAlgorithm: \" + keyAlg);","tryCatchPattern":"try {\n    PrivateKey key = LetsEncryptHelpers.getPrivateKey(encoded, alg);\n} catch (RuntimeException e) {\n    LOGGER.error(\"Stored private key unreadable (wrong format?); regenerate key\", e);\n    deleteKeyAndRenew();\n}","preventionTips":["Always store keys in PKCS#8 (convert PKCS#1 with openssl pkcs8 -topk8)","Keep keyAlgorithm config in sync with the actual key type","Never hand-edit or truncate key files; regenerate via the tooling","Back up the key directory so corruption can be recovered from a known-good copy"],"tags":["private-key","pkcs8","base64","acme"],"backgroundTag":"invalid-private-key-format","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}