{"record":{"id":"c45c39f990c24c72","repo":"denoland/deno","slug":"can-not-create-private-key-from-type-key","errorCode":null,"errorMessage":"Can not create private key from ${type} key","messagePattern":"Can not create private key from (.+?) key","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/keys.ts","lineNumber":616,"sourceCode":"      e.message,\n      \"error:1E08010C:DECODER routines::unsupported\",\n    )\n  ) {\n    if (e.library === undefined) e.library = \"DECODER routines\";\n  }\n  return err;\n}\n\nfunction createPrivateKey(\n  key: any,\n): PrivateKeyObject {\n  const res = prepareAsymmetricKey(key, kCreatePrivate);\n  if (ObjectHasOwn(res, \"handle\")) {\n    const type = op_node_key_type(res.handle);\n    if (type === \"private\") {\n      return new PrivateKeyObject(res.handle);\n    } else {\n      throw new TypeError(`Can not create private key from ${type} key`);\n    }\n  } else {\n    let handle;\n    try {\n      handle = op_node_create_private_key(\n        res.data,\n        res.format,\n        res.type ?? \"\",\n        res.passphrase,\n      );\n    } catch (err) {\n      throw decorateOsslDecoderError(err);\n    }\n    return new PrivateKeyObject(handle);\n  }\n}\n\nfunction createPublicKey(","sourceCodeStart":598,"sourceCodeEnd":634,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/keys.ts#L598-L634","documentation":"createPrivateKey was handed an existing KeyObject or CryptoKey whose type is not 'private' — it is 'public' or 'secret'. The handle path checks op_node_key_type and throws a TypeError whose message interpolates the actual type, e.g. 'Can not create private key from public key'. Private material cannot be derived from public material, so the request is impossible by construction.","triggerScenarios":"crypto.createPrivateKey(publicKeyObject); crypto.createPrivateKey(secretKey); createPrivateKey(cryptoKey) where the CryptoKey was imported from an spki/public JWK source.","commonSituations":"JWKS verification code selecting the certificate's public key where the private key was expected; loading the TLS cert instead of the key file in a signing service; a variable that was overwritten with the wrong KeyObject earlier in the flow.","solutions":["Pass real private material: a PEM/PKCS#8 string, an encrypted PEM plus passphrase, a DER buffer, or a JWK containing 'd'","Load the private key from its own source (-----BEGIN PRIVATE KEY----- file, env var), never from the certificate or public JWK","Store key pairs as { public, private } and pick the right member explicitly","Branch on keyObject.type === 'private' before calling createPrivateKey"],"exampleFix":"// before: cert's public key used for signing\nconst signer = crypto.createPrivateKey(cert.publicKey); // throws TypeError\n\n// after: load the private key material\nconst signer = crypto.createPrivateKey({\n  key: fs.readFileSync('/srv/keys/svc.pem'),\n  format: 'pem',\n});","handlingStrategy":"type-guard","validationCode":"function toPrivateKey(material) {\n  if (material && typeof material === 'object' && 'type' in material) {\n    if (material.type !== 'private') {\n      throw new TypeError(`Need a private key, got ${material.type}`);\n    }\n    return material; // already a KeyObject\n  }\n  return crypto.createPrivateKey(material);\n}","typeGuard":"function isPrivateKeyObject(key: unknown): key is crypto.PrivateKeyObject {\n  return !!key && typeof key === 'object' &&\n    (key as crypto.KeyObject).type === 'private';\n}","tryCatchPattern":"try {\n  return crypto.createPrivateKey(key);\n} catch (err) {\n  if (err instanceof TypeError && /Can not create private key from/.test(err.message)) {\n    throw new Error('Refusing to sign: only public/secret material found. Load the private key file.');\n  }\n  throw err;\n}","preventionTips":["Separate public and private key loading into distinct named functions","Assert key.type === 'private' before any signing operation","Never derive the 'signing key' from a certificate object; load the key file directly"],"tags":["crypto","key-import","keyobject","node-compat"],"backgroundTag":"key-object-type-mismatch","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}