{"record":{"id":"af861cdcf3b5ee87","repo":"karatelabs/karate","slug":"failed-to-load-private-key-unsupported-algorithm","errorCode":null,"errorMessage":"failed to load private key: unsupported algorithm","messagePattern":"failed to load private key: unsupported algorithm","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/core/SslContextFactory.java","lineNumber":212,"sourceCode":"        // Remove PEM headers/footers and decode\n        String privateKeyPEM = keyString\n                .replace(\"-----BEGIN PRIVATE KEY-----\", \"\")\n                .replace(\"-----END PRIVATE KEY-----\", \"\")\n                .replace(\"-----BEGIN RSA PRIVATE KEY-----\", \"\")\n                .replace(\"-----END RSA PRIVATE KEY-----\", \"\")\n                .replaceAll(\"\\\\s\", \"\");\n\n        byte[] decoded = Base64.getDecoder().decode(privateKeyPEM);\n        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(decoded);\n\n        // Try RSA first, then EC\n        try {\n            return KeyFactory.getInstance(\"RSA\").generatePrivate(keySpec);\n        } catch (Exception e) {\n            try {\n                return KeyFactory.getInstance(\"EC\").generatePrivate(keySpec);\n            } catch (Exception e2) {\n                throw new RuntimeException(\"failed to load private key: unsupported algorithm\", e2);\n            }\n        }\n    }\n\n    /**\n     * Load resource from path (supports classpath: prefix).\n     */\n    private static byte[] loadResource(String path) {\n        Resource resource = Resource.path(path);\n        return FileUtils.toBytes(resource.getText());\n    }\n\n}\n","sourceCodeStart":194,"sourceCodeEnd":226,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/core/SslContextFactory.java#L194-L226","documentation":"When loading a PEM private key, loadPrivateKey first tries RSA then EC KeyFactory. If both fail, it concludes the key uses an unsupported algorithm and throws \"failed to load private key: unsupported algorithm\" (wrapping the EC failure).","triggerScenarios":"Calling the SSL server/cert setup with a private key PEM that is neither RSA nor EC — e.g. Ed25519 keys, DSA keys, or PKCS#8 content the KeyFactory can't interpret.","commonSituations":"Modern ssh-keygen/openssl generating Ed25519 keys by default; DSA keys from legacy tooling; a certificate pasted where a key belongs; PEM header mismatch (e.g. encrypted PKCS#8).","solutions":["Regenerate/convert the key to RSA: `openssl genrsa -out server.key 2048` or `openssl pkey -in key.pem -traditional` conversion as appropriate","Check the PEM header — use `-----BEGIN PRIVATE KEY-----` (PKCS#8) or `-----BEGIN RSA PRIVATE KEY-----` unencrypted material","If you need EC, ensure the key is a standard curve (prime256v1/secp384r1); otherwise use RSA"],"exampleFix":"// before: ssh-keygen -t ed25519 (unsupported)\n// after\n$ openssl genrsa -out server.key 2048\n$ openssl req -new -x509 -key server.key -out server.crt","handlingStrategy":"validation","validationCode":"// detect the key type before loading\nString head = java.nio.file.Files.readAllLines(java.nio.file.Path.of(keyPath)).get(0);\n// accept only RSA/EC-compatible PKCS material\nif (head.contains(\"ED25519\") || head.contains(\"DSA\")) throw new IllegalStateException(\"unsupported key algorithm, regenerate as RSA\");","typeGuard":null,"tryCatchPattern":"try { SslContextFactory.loadPrivateKey(pemBytes); } catch (RuntimeException e) { throw new IllegalStateException(\"convert key to RSA or standard EC curve: openssl genrsa -out key 2048\", e); }","preventionTips":["Generate keys with RSA (2048+) or standard EC curves; avoid Ed25519/DSA","Never paste a certificate where a private key belongs","Use unencrypted PKCS#8 PEM for server keys"],"tags":["ssl","pem","key","unsupported-algorithm"],"backgroundTag":"unsupported-operation","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}