{"record":{"id":"bfe936ba3fe49379","repo":"jackc/pgx","slug":"unable-to-decrypt-key-w","errorCode":null,"errorMessage":"unable to decrypt key: %w","messagePattern":"unable to decrypt key: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/config.go","lineNumber":957,"sourceCode":"\t\t\t// Attempt decryption with pass phrase\n\t\t\t// NOTE: only supports RSA (PKCS#1)\n\t\t\tif sslpassword != \"\" {\n\t\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword)) //nolint:ineffassign\n\t\t\t}\n\t\t\t// if sslpassword not provided or has decryption error when use it\n\t\t\t// try to find sslpassword with callback function\n\t\t\tif sslpassword == \"\" || decryptedError != nil {\n\t\t\t\tif parseConfigOptions.GetSSLPassword != nil {\n\t\t\t\t\tsslpassword = parseConfigOptions.GetSSLPassword(context.Background())\n\t\t\t\t}\n\t\t\t\tif sslpassword == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unable to find sslpassword\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword))\n\t\t\t// Should we also provide warning for PKCS#1 needed?\n\t\t\tif decryptedError != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"unable to decrypt key: %w\", decryptedError)\n\t\t\t}\n\n\t\t\tpemBytes := pem.Block{\n\t\t\t\tType:  \"RSA PRIVATE KEY\",\n\t\t\t\tBytes: decryptedKey,\n\t\t\t}\n\t\t\tpemKey = pem.EncodeToMemory(&pemBytes)\n\t\t} else {\n\t\t\tpemKey = pem.EncodeToMemory(block)\n\t\t}\n\t\tcertfile, err := os.ReadFile(sslcert)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to read cert: %w\", err)\n\t\t}\n\t\tcert, err := tls.X509KeyPair(certfile, pemKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load cert: %w\", err)\n\t\t}","sourceCodeStart":939,"sourceCodeEnd":975,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/config.go#L939-L975","documentation":"The encrypted SSL client key could not be decrypted with the supplied password. The wrapped error is from x509.DecryptPEMBlock, typically a wrong password or an unsupported encryption scheme (only RSA PKCS#1 is supported).","triggerScenarios":"Thrown at pgconn/config.go:957 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the sslpassword is correct for this key","Regenerate the key if it uses an unsupported format; only RSA PKCS#1 PEM encryption is supported","Use openssl rsa -in key.pem -check to validate the key/password pair","Consider supplying the password via the GetSSLPassword callback"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}