{"record":{"id":"c48a60711c6522e8","repo":"t8y2/dbx","slug":"unsupported-private-key-encoding","errorCode":null,"errorMessage":"unsupported private key encoding","messagePattern":"unsupported private key encoding","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_tls.go","lineNumber":239,"sourceCode":"\t\tcertificates = append(certificates, certificate)\n\t}\n\tif len(certificates) == 0 {\n\t\treturn nil, errors.New(\"PEM truststore contains no certificates\")\n\t}\n\treturn certificates, nil\n}\n\nfunc parsePrivateKey(contents []byte) (any, error) {\n\tif value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\tif value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\tif value, err := x509.ParseECPrivateKey(contents); err == nil {\n\t\treturn value, nil\n\t}\n\treturn nil, errors.New(\"unsupported private key encoding\")\n}\n","sourceCodeStart":221,"sourceCodeEnd":241,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_tls.go#L221-L241","documentation":"parsePrivateKey attempts to decode a private key as PKCS#8, then PKCS#1, then EC SEC1 formats. If none parse, it returns this error. The key bytes are in a format the Go stdlib parsers in this function do not handle.","triggerScenarios":"loadClientKeyStore encounters a PEM PRIVATE KEY block whose DER payload is not PKCS8/PKCS1/EC — most commonly an encrypted PKCS#8 key ('ENCRYPTED PRIVATE KEY') or a passphrase-protected key, or garbage/truncated PEM content.","commonSituations":"Key generated with a passphrase and never decrypted; a key in OpenSSL 'traditional' format from an unusual cipher; file corrupted during secret templating; passing a public key or CSR file instead of the private key.","solutions":["Decrypt the key so it is unencrypted PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem (supply the passphrase once)","Convert to PKCS#8 explicitly: openssl pkey -in key.pem -out key.pkcs8.pem","Verify the PEM header is 'BEGIN PRIVATE KEY' or 'BEGIN RSA PRIVATE KEY', not 'BEGIN ENCRYPTED PRIVATE KEY'","Confirm the file actually holds a private key, not a CSR or public key"],"exampleFix":"// before\n-----BEGIN ENCRYPTED PRIVATE KEY-----\n// after\n# openssl pkcs8 -topk8 -nocrypt -in encrypted-key.pem -out key.pem\n-----BEGIN PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(keyPEM)\nif block == nil || strings.Contains(block.Type, \"ENCRYPTED\") {\n    return fmt.Errorf(\"private key must be unencrypted PKCS8/PKCS1/EC PEM\")\n}","typeGuard":null,"tryCatchPattern":"key, err := parsePrivateKey(contents)\nif err != nil && strings.Contains(err.Error(), \"unsupported private key encoding\") {\n    // re-encode: openssl pkey -in key.pem -out key.pkcs8.pem\n}","preventionTips":["Store private keys as unencrypted PKCS#8 ('BEGIN PRIVATE KEY')","Never mount passphrase-protected keys where the agent cannot decrypt them","Verify header type after any secret templating step"],"tags":["tls","pem","private-key","key-format","pkcs8"],"backgroundTag":"unsupported-key-format","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}