{"record":{"id":"c1b4b70b9b30972c","repo":"t8y2/dbx","slug":"unsupported-private-key-encoding-c1b4b7","errorCode":null,"errorMessage":"unsupported private key encoding","messagePattern":"unsupported private key encoding","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":239,"sourceCode":"\t\tcertificates = append(certificates, certificate)\n\t}\n\tif len(certificates) == 0 {\n\t\treturn nil, errors.New(\"PEM truststore contains no certificates\")\n\t}\n\treturn certificates, nil\n}\n\nfunc parsePrivateKey(contents []byte) (any, error) {\n\tif value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\tif value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\tif value, err := x509.ParseECPrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\treturn nil, errors.New(\"unsupported private key encoding\")\n}\n","sourceCodeStart":221,"sourceCodeEnd":241,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L221-L241","documentation":"parsePrivateKey tries PKCS#8, PKCS#1 (RSA), and SEC1 (EC) PEM decodings in order; if none succeed, the key bytes are in an unrecognized encoding and the library returns this error instead of a private key.","triggerScenarios":"The client key file is encrypted (PEM with Proc-Type/DEK-Info headers), malformed, or in an unsupported format (e.g. OpenSSL 'traditional' formats not covered, or a PKCS#12 blob passed as a key).","commonSituations":"Password-protected keys where no passphrase was stripped; keys converted with unusual tooling; accidentally passing the certificate file as the key path.","solutions":["Check the key file actually contains '-----BEGIN ... PRIVATE KEY-----' and is not the certificate.","Decrypt/re-encode the key unencrypted to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem.","If the key is encrypted, remove the passphrase (openssl rsa -in key.pem -out key-nopass.pem) or supply it via the mechanism the driver supports."],"exampleFix":"# before: encrypted or traditional key fails parse\n-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\n// after\nopenssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pem\n-----BEGIN PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"func keyIsParseablePEM(path string) error {\n\tb, err := os.ReadFile(path); if err != nil { return err }\n\tblock, _ := pem.Decode(b)\n\tif block == nil { return errors.New(\"not PEM\") }\n\tswitch block.Type {\n\tcase \"PRIVATE KEY\", \"RSA PRIVATE KEY\", \"EC PRIVATE KEY\":\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"unsupported PEM block %q (encrypted?)\", block.Type)\n}","typeGuard":"func isSupportedKeyPEM(block *pem.Block) bool {\n\treturn block != nil && (block.Type == \"PRIVATE KEY\" || block.Type == \"RSA PRIVATE KEY\" || block.Type == \"EC PRIVATE KEY\")\n}","tryCatchPattern":"key, err := parsePrivateKey(contents)\nif err != nil {\n\tif strings.Contains(err.Error(), \"unsupported private key encoding\") {\n\t\treturn fmt.Errorf(\"re-encode key with: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pem\")\n\t}\n\treturn err\n}","preventionTips":["Store client keys as unencrypted PKCS#8 PEM ('BEGIN PRIVATE KEY').","Strip passphrases before deployment or supply them via the supported config mechanism.","Confirm the key path config points at the key file, not the certificate."],"tags":["tls","pem","private-key","pkcs8","zookeeper"],"backgroundTag":"unsupported-key-format","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}