{"record":{"id":"be35b51922588b6b","repo":"OpenNHP/opennhp","slug":"private-key-parse-error-v-be35b5","errorCode":null,"errorMessage":"private key parse error %v","messagePattern":"private key parse error (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"endpoints/db/udpdevice.go","lineNumber":139,"sourceCode":"\t// init logger\n\ta.log = log.NewLogger(\"NHP-DB\", logLevel, filepath.Join(ExeDirPath, \"logs\"), \"device\")\n\tlog.SetGlobalLogger(a.log)\n\n\tlog.Info(\"=========================================================\")\n\tlog.Info(\"=== NHP-DB %s started                           ===\", version.Version)\n\tlog.Info(\"=== REVISION %s ===\", version.CommitId)\n\tlog.Info(\"=== RELEASE %s                       ===\", version.BuildTime)\n\tlog.Info(\"=========================================================\")\n\n\terr = a.loadBaseConfig()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tprk, err := base64.StdEncoding.DecodeString(a.config.PrivateKeyBase64)\n\tif err != nil {\n\t\tlog.Error(\"private key parse error %v\\n\", err)\n\t\treturn fmt.Errorf(\"private key parse error %v\", err)\n\t}\n\n\ta.device = core.NewDevice(core.NHP_DB, prk, nil)\n\tif a.device == nil {\n\t\tlog.Critical(\"failed to create device %v\\n\", err)\n\t\treturn fmt.Errorf(\"failed to create device %v\", err)\n\t}\n\n\ta.remoteConnectionMap = make(map[string]*UdpConn)\n\ta.serverPeerMap = make(map[string]*core.UdpPeer)\n\n\t// load peers\n\t_ = a.loadPeers()\n\n\t// load TEEs\n\t_ = a.loadTEEs()\n\n\ta.signals.stop = make(chan struct{})","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/udpdevice.go#L121-L157","documentation":"UdpDevice.Start decodes the device's private key from config (PrivateKeyBase64) using base64.StdEncoding before constructing the core device. If the configured string is not valid standard base64 (or empty after trimming), the decode fails, the error is logged, and Start aborts with 'private key parse error <detail>'. The device cannot run without a valid identity key.","triggerScenarios":"Starting nhp-db (`nhp-device run` with a config whose PrivateKeyBase64 in config.toml is empty, truncated, contains whitespace/newlines, was generated with URL-safe base64 instead of StdEncoding, or is not base64 at all.","commonSituations":"Hand-editing config.toml and corrupting the key; pasting a hex key into a base64 field; env-subst templates leaving ${...} unresolved; switching keys generated by different tooling; missing config file defaulting the field to empty.","solutions":["Regenerate a proper key pair with `nhp-device keygen` and paste the privateKey value into config.toml PrivateKeyBase64","Ensure the value is exact standard base64 with no quotes, whitespace or line breaks","Check that the config template/environment actually rendered the key (no empty ${VAR})","Verify you are editing the config file the process actually loads"],"exampleFix":"// before (config.toml)\nprivateKeyBase64 = \"\"\n// after (config.toml)\nprivateKeyBase64 = \"MC4CAQAwBQYDK2VwBCIEIJ...\"  # output of `nhp-device keygen --curve --json`","handlingStrategy":"validation","validationCode":"const raw = config.privateKeyBase64;\nif (!raw || Buffer.from(raw, 'base64').toString('base64') !== raw) {\n  throw new Error('config privateKeyBase64 is missing or not valid standard base64');\n}","typeGuard":"const isValidBase64 = (s) => typeof s === 'string' && s.length > 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(s) && Buffer.from(s, 'base64').toString('base64') === s;","tryCatchPattern":"if err := device.Start(); err != nil {\n  if strings.HasPrefix(err.Error(), \"private key parse error\") {\n    // regenerate key, fix config, then restart\n  }\n  return err\n}","preventionTips":["Provision keys only via `nhp-device keygen` output","Validate config.toml at deploy time (base64-decode every key field)","Render templates with strict env var checks so keys cannot end up empty","Strip whitespace/newlines when pasting keys into config"],"tags":["config","base64","keys","startup"],"backgroundTag":"invalid-config-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}