{"record":{"id":"a8d940d600cb4117","repo":"hashicorp/nomad","slug":"unknown-pem-block-type-for-signing-key-s","errorCode":null,"errorMessage":"unknown PEM block type for signing key: %s","messagePattern":"unknown PEM block type for signing key: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":341,"sourceCode":"\t\treturn x509.ParseECPrivateKey(block.Bytes)\n\n\tcase \"RSA PRIVATE KEY\":\n\t\treturn x509.ParsePKCS1PrivateKey(block.Bytes)\n\n\tcase \"PRIVATE KEY\":\n\t\tsigner, err := x509.ParsePKCS8PrivateKey(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tpk, ok := signer.(crypto.Signer)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"private key is not a valid format\")\n\t\t}\n\n\t\treturn pk, nil\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown PEM block type for signing key: %s\", block.Type)\n\t}\n}\n\nfunc Verify(caString, certString, dns string) error {\n\troots := x509.NewCertPool()\n\tok := roots.AppendCertsFromPEM([]byte(caString))\n\tif !ok {\n\t\treturn fmt.Errorf(\"failed to parse root certificate\")\n\t}\n\n\tcert, err := parseCert(certString)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse certificate\")\n\t}\n\n\topts := x509.VerifyOptions{\n\t\tDNSName: fmt.Sprint(dns),\n\t\tRoots:   roots,","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L323-L359","documentation":"ParseSigner parses a PEM-encoded private key and returns a crypto.Signer. It supports RSA, EC, and PKCS#8 (Ed25519) PEM blocks; any other PEM block type reaches the default branch and this error is thrown, carrying the unrecognized block.Type header.","triggerScenarios":"Calling ParseSigner (directly or via newCert/Run/IsValidSigner in tlsutil) with PEM data whose block type is not 'RSA PRIVATE KEY', 'EC PRIVATE KEY', or 'PRIVATE KEY' — e.g. a public key, certificate, or encrypted key block passed where a private key is expected.","commonSituations":"Pointing a CA/leaf key config at the certificate file instead of the key file; passing an encrypted 'ENCRYPTED PRIVATE KEY' or legacy format; concatenating cert+key in one file and feeding the whole bundle to ParseSigner.","solutions":["Inspect block.Type with pem.Decode on the file and confirm it contains the intended private key, not the certificate","Regenerate or export the key as PKCS#8 ('BEGIN PRIVATE KEY') or the matching RSA/EC private-key PEM format","If the file holds a cert+key bundle, split out only the private-key section before parsing"],"exampleFix":"// before\nsigner, err := tlsutil.ParseSigner(certPEM) // cert block, not key\n// after\nsigner, err := tlsutil.ParseSigner(keyPEM) // block type: RSA/EC PRIVATE KEY or PRIVATE KEY","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(keyPEM)\nif block == nil {\n\treturn fmt.Errorf(\"no PEM data found\")\n}\nswitch block.Type {\ncase \"RSA PRIVATE KEY\", \"EC PRIVATE KEY\", \"PRIVATE KEY\":\n\t// ok\ndefault:\n\treturn fmt.Errorf(\"unsupported key block type %q\", block.Type)\n}\nsigner, err := tlsutil.ParseSigner(keyPEM)","typeGuard":"func isPrivateKeyPEM(pemBytes []byte) bool {\n\tblock, _ := pem.Decode(pemBytes)\n\treturn block != nil && (block.Type == \"RSA PRIVATE KEY\" || block.Type == \"EC PRIVATE KEY\" || block.Type == \"PRIVATE KEY\")\n}","tryCatchPattern":"signer, err := tlsutil.ParseSigner(keyPEM)\nif err != nil {\n\tif strings.HasPrefix(err.Error(), \"unknown PEM block type\") {\n\t\treturn fmt.Errorf(\"key file is not a supported private key PEM (check cert vs key): %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Keep certificate and key files separate; never feed a combined bundle to ParseSigner","Check the PEM BEGIN line before parsing to confirm it is a private key","Standardize on PKCS#8 ('BEGIN PRIVATE KEY') key encoding","Reject encrypted password-protected keys at config load time"],"tags":["tls","pem","certificate","key-format"],"backgroundTag":"invalid-pem-block-type","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}