{"record":{"id":"b344fbac8c9ac4b4","repo":"hyperledger/fabric","slug":"found-unknown-private-key-type-t-in-pkcs-8-wrap","errorCode":null,"errorMessage":"found unknown private key type (%T) in PKCS#8 wrapping","messagePattern":"found unknown private key type \\(%T\\) in PKCS#8 wrapping","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/common/signer/signer.go","lineNumber":136,"sourceCode":"\tkey, err := parsePrivateKey(bl.Bytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn key, nil\n}\n\n// Based on crypto/tls/tls.go but modified for Fabric:\nfunc parsePrivateKey(der []byte) (crypto.PrivateKey, error) {\n\t// OpenSSL 1.0.0 generates PKCS#8 keys.\n\tif key, err := x509.ParsePKCS8PrivateKey(der); err == nil {\n\t\tswitch key := key.(type) {\n\t\t// Fabric only supports ECDSA at the moment.\n\t\tcase *ecdsa.PrivateKey:\n\t\t\treturn key, nil\n\t\tcase ed25519.PrivateKey:\n\t\t\treturn key, nil\n\t\tdefault:\n\t\t\treturn nil, errors.Errorf(\"found unknown private key type (%T) in PKCS#8 wrapping\", key)\n\t\t}\n\t}\n\n\t// OpenSSL ecparam generates SEC1 EC private keys for ECDSA.\n\tkey, err := x509.ParseECPrivateKey(der)\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed to parse private key: %v\", err)\n\t}\n\n\treturn key, nil\n}\n\nfunc signECDSA(k *ecdsa.PrivateKey, digest []byte) (signature []byte, err error) {\n\tr, s, err := ecdsa.Sign(rand.Reader, k, digest)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/cmd/common/signer/signer.go#L118-L154","documentation":"parsePrivateKey first attempts x509.ParsePKCS8PrivateKey; PKCS#8 parsing succeeded but yielded a key type other than *ecdsa.PrivateKey or ed25519.PrivateKey (most commonly *rsa.PrivateKey), so this error names the unsupported type found inside the PKCS#8 structure.","triggerScenarios":"Loading a PKCS#8-wrapped RSA private key (e.g. '-----BEGIN PRIVATE KEY-----' containing an RSA key) via NewSigner -> loadPrivateKey -> parsePrivateKey and calling Sign.","commonSituations":"Keys generated with default openssl genrsa then converted to PKCS#8; cloud CAs issuing RSA keys by default; shared scripts generating keys without specifying EC curve.","solutions":["Generate an ECDSA key: openssl ecparam -name prime256v1 -genkey -noout -out key.pem and re-enroll/re-register identity","Convert nothing — RSA keys cannot be converted to ECDSA; obtain a new ECDSA key from the CA","Verify key type: openssl pkey -in key.pem -noout -text (should show 'Private-Key: (256 bit)' with NIST CURVE)","If your tooling must support RSA, extend parsePrivateKey's switch explicitly"],"exampleFix":"// before\nopenssl genrsa -out key.pem 2048\nopenssl pkcs8 -topk8 -nocrypt -in key.pem -out key.p8\n// after\nopenssl ecparam -name prime256v1 -genkey -noout -out key.pem","handlingStrategy":"validation","validationCode":"b, _ := os.ReadFile(keyPath)\nblk, _ := pem.Decode(b)\nkey, err := x509.ParsePKCS8PrivateKey(blk.Bytes)\nif err == nil {\n    switch key.(type) {\n    case *ecdsa.PrivateKey, ed25519.PrivateKey:\n    default:\n        return fmt.Errorf(\"unsupported PKCS#8 key type %T\", key)\n    }\n}","typeGuard":"func isSupportedPKCS8(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    if blk == nil { return false }\n    k, err := x509.ParsePKCS8PrivateKey(blk.Bytes)\n    if err != nil { return true /* may be SEC1, handled later */ }\n    switch k.(type) {\n    case *ecdsa.PrivateKey, ed25519.PrivateKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":"s, err := signer.NewSigner(keyPath, idPath)\nif err != nil {\n    if strings.Contains(err.Error(), \"PKCS#8 wrapping\") {\n        return fmt.Errorf(\"key %s is RSA; provision an ECDSA key\", keyPath)\n    }\n    return err\n}","preventionTips":["Use -name prime256v1 (or Ed25519) when generating keys","Audit CA templates so issued keys are ECDSA not RSA","Check key headers before distribution: RSA PRIVATE KEY is unsupported"],"tags":["crypto","pkcs8","rsa","fabric","unsupported-key-type"],"backgroundTag":"unsupported-private-key-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}