{"record":{"id":"ae78dfde2e301bc8","repo":"caddyserver/caddy","slug":"expected-elliptic-private-key-to-immediately-follo","errorCode":null,"errorMessage":"expected elliptic private key to immediately follow EC parameters","messagePattern":"expected elliptic private key to immediately follow EC parameters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/folderloader.go","lineNumber":135,"sourceCode":"\n\t\tif derBlock.Type == \"CERTIFICATE\" {\n\t\t\t// Re-encode certificate as PEM, appending to certificate chain\n\t\t\tif err := pem.Encode(certBuilder, derBlock); err != nil {\n\t\t\t\treturn tls.Certificate{}, err\n\t\t\t}\n\t\t} else if derBlock.Type == \"EC PARAMETERS\" {\n\t\t\t// EC keys generated from openssl can be composed of two blocks:\n\t\t\t// parameters and key (parameter block should come first)\n\t\t\tif !foundKey {\n\t\t\t\t// Encode parameters\n\t\t\t\tif err := pem.Encode(keyBuilder, derBlock); err != nil {\n\t\t\t\t\treturn tls.Certificate{}, err\n\t\t\t\t}\n\n\t\t\t\t// Key must immediately follow\n\t\t\t\tderBlock, bundle = pem.Decode(bundle)\n\t\t\t\tif derBlock == nil || derBlock.Type != \"EC PRIVATE KEY\" {\n\t\t\t\t\treturn tls.Certificate{}, fmt.Errorf(\"expected elliptic private key to immediately follow EC parameters\")\n\t\t\t\t}\n\t\t\t\tif err := pem.Encode(keyBuilder, derBlock); err != nil {\n\t\t\t\t\treturn tls.Certificate{}, err\n\t\t\t\t}\n\t\t\t\tfoundKey = true\n\t\t\t}\n\t\t} else if derBlock.Type == \"PRIVATE KEY\" || strings.HasSuffix(derBlock.Type, \" PRIVATE KEY\") {\n\t\t\t// RSA key\n\t\t\tif !foundKey {\n\t\t\t\tif err := pem.Encode(keyBuilder, derBlock); err != nil {\n\t\t\t\t\treturn tls.Certificate{}, err\n\t\t\t\t}\n\t\t\t\tfoundKey = true\n\t\t\t}\n\t\t} else {\n\t\t\treturn tls.Certificate{}, fmt.Errorf(\"unrecognized PEM block type: %s\", derBlock.Type)\n\t\t}\n\t}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/folderloader.go#L117-L153","documentation":"Error \"expected elliptic private key to immediately follow EC parameters\" thrown in caddyserver/caddy.","triggerScenarios":"Thrown at modules/caddytls/folderloader.go:135 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-encode the EC private key in standard SEC1 or PKCS#8 PEM form; the EC parameters block placement is invalid."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}