{"record":{"id":"c2ec97d77f6546b6","repo":"apache/beam","slug":"private-key-encryption-algorithm-not-supported-this-may-mean","errorCode":null,"errorMessage":"Private key encryption algorithm not supported. This may mean that the private key was generated by OpenSSL 1.1.1g or newer which uses an encryption algorithm by default which has compatibility issues in some JVM environments. For details, see: https://community.snowflake.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID + e.getMessage()","messagePattern":"Private key encryption algorithm not supported\\. This may mean that the private key was generated by OpenSSL 1\\.1\\.1g or newer which uses an encryption algorithm by default which has compatibility issues in some JVM environments\\. For details, see: https://community\\.snowflake\\.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID \\+ e\\.getMessage\\(\\)","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java","lineNumber":93,"sourceCode":"        decoded = pemObject.getContent();\n        pr.close();\n      }\n\n      if (Strings.isNullOrEmpty(privateKeyPassphrase)) {\n        // unencrypted private key file\n        PKCS8EncodedKeySpec encodedKeySpec = new PKCS8EncodedKeySpec(decoded);\n        return keyFactory.generatePrivate(encodedKeySpec);\n      } else {\n        // encrypted private key file\n        EncryptedPrivateKeyInfo pkInfo = new EncryptedPrivateKeyInfo(decoded);\n        PBEKeySpec keySpec = new PBEKeySpec(privateKeyPassphrase.toCharArray());\n        SecretKeyFactory pbeKeyFactory = SecretKeyFactory.getInstance(pkInfo.getAlgName());\n        PKCS8EncodedKeySpec encodedKeySpec =\n            pkInfo.getKeySpec(pbeKeyFactory.generateSecret(keySpec));\n        return keyFactory.generatePrivate(encodedKeySpec);\n      }\n    } catch (NoSuchAlgorithmException e) {\n      throw new RuntimeException(\n          \"Private key encryption algorithm not supported. This may mean that the private key was generated by OpenSSL 1.1.1g or newer \"\n              + \"which uses an encryption algorithm by default which has compatibility issues in some JVM environments. \"\n              + \"For details, see: \"\n              + \"https://community.snowflake.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID\"\n              + \" \"\n              + e.getMessage());\n    } catch (InvalidKeySpecException\n        | IOException\n        | IllegalArgumentException\n        | NullPointerException\n        | InvalidKeyException\n        | DecoderException e) {\n      throw new RuntimeException(\"Can't create private key: \" + e.getMessage(), e);\n    }\n  }\n\n  /**\n   * Tries to determine whether the private key is encrypted or not based on the file headers.","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java#L75-L111","documentation":"While decrypting an encrypted PKCS#8 private key, SecretKeyFactory.getInstance throws NoSuchAlgorithmException when the JVM lacks the key's PBE encryption algorithm. The library wraps it in this RuntimeException pointing to Snowflake's known OpenSSL 1.1.1g+ compatibility article.","triggerScenarios":"Loading an encrypted private key generated with OpenSSL 1.1.1g or newer (default PBES2/AES-256-CBC with PBKDF2) on a JVM whose SecretKeyFactory doesn't support that algorithm, via preparePrivateKey.","commonSituations":"Java 8 or restricted JCE environments; keys generated on modern Linux (OpenSSH/OpenSSL) then used in JVMs lacking the newer algorithms; FIPS-enabled JVMs.","solutions":["Regenerate the key unencrypted: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-nocrypt.pem and drop the passphrase.","Regenerate the key with a widely supported algorithm: openssl pkcs8 -topk8 -v1 PBE-SHA1-3DES.","Use Snowflake's suggested conversion per the linked article (decrypt/re-encrypt with openssl pkcs8 -topk8).","Run on a JVM/JCE provider that supports the algorithm, or add a provider like BouncyCastle."],"exampleFix":"// before (shell)\nopenssl genpkey -algorithm RSA -aes256 -out key.pem\n// after (shell)\nopenssl genpkey -algorithm RSA -out key.pem   # or re-encrypt with -v1 PBE-SHA1-3DES","handlingStrategy":"try-catch","validationCode":"// Probe JVM support before using the key\ntry {\n  SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA256\");\n} catch (NoSuchAlgorithmException e) {\n  throw new IllegalStateException(\"JVM lacks PBE support; regenerate key with -v1 PBE-SHA1-3DES\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  PrivateKey pk = KeyPairUtils.preparePrivateKey(pem, passphrase);\n} catch (RuntimeException e) {\n  if (e.getMessage().startsWith(\"Private key encryption algorithm not supported\")) {\n    // fall back: re-encrypt key with openssl -v1 PBE-SHA1-3DES or use unencrypted key\n  }\n  throw e;\n}","preventionTips":["Generate keys unencrypted or with -v1 PBE-SHA1-3DES for maximum JVM compatibility.","Standardize the key-generation command in onboarding docs.","Test key loading on the exact target JVM image in CI."],"tags":["snowflake","private-key","openssl","jvm-compatibility"],"backgroundTag":"unsupported-operation","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}