{"record":{"id":"c5605673d0793ef5","repo":"ory/hydra","slug":"failed-to-encode-private-key-s","errorCode":null,"errorMessage":"failed to encode private key: %s","messagePattern":"failed to encode private key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":284,"sourceCode":"\t\tNotAfter:              time.Now().UTC().Add(time.Hour * 24 * 31),\n\t\tKeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},\n\t\tBasicConstraintsValid: true,\n\t\tIsCA:                  true,\n\t\tDNSNames:              []string{\"localhost\"},\n\t}\n\tfor _, opt := range opts {\n\t\topt(certificate)\n\t}\n\n\tder, err := x509.CreateCertificate(rand.Reader, certificate, certificate, PublicKey(key), key)\n\tif err != nil {\n\t\treturn cert, errors.Errorf(\"failed to create certificate: %s\", err)\n\t}\n\n\tcert, err = x509.ParseCertificate(der)\n\tif err != nil {\n\t\treturn cert, errors.Errorf(\"failed to encode private key: %s\", err)\n\t}\n\treturn cert, nil\n}\n\n// PEMBlockForKey returns a PEM-encoded block for key.\nfunc PEMBlockForKey(key interface{}) (*pem.Block, error) {\n\tb, err := x509.MarshalPKCS8PrivateKey(key)\n\tif err != nil {\n\t\treturn nil, errors.WithStack(err)\n\t}\n\treturn &pem.Block{Type: \"PRIVATE KEY\", Bytes: b}, nil\n}\n\n// NewClientCert creates a new client TLS certificate signed by the given CA.\nfunc NewClientCert(CAcert *x509.Certificate, CAkey crypto.PrivateKey, opts ...CertificateOpts) (*tls.Certificate, error) {\n\tif !slices.Contains(CAcert.ExtKeyUsage, x509.ExtKeyUsageClientAuth) {\n\t\treturn nil, errors.Errorf(\"the CA certificate does not have the client authentication extended key usage (OID 1.3.6.1.5.5.7.3.2) set\")\n\t}","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L266-L302","documentation":"After successfully creating the DER-encoded certificate, CreateSelfSignedCertificate parses it back with x509.ParseCertificate to return an *x509.Certificate. If that parse fails, it returns this error (whose wording — 'failed to encode private key' — is misleading; it actually means the freshly generated certificate could not be parsed). In practice this is nearly impossible unless the crypto/x509 implementation is broken or a CertificateOpts produced a malformed template.","triggerScenarios":"x509.ParseCertificate rejecting the DER bytes returned by x509.CreateCertificate — essentially only possible with a corrupted crypto stack or an exotic opts callback that produced an invalid certificate structure.","commonSituations":"Extremely rare; occasionally seen on platforms with patched/broken crypto libraries, or when a custom CertificateOpts injects invalid extensions the parser then rejects.","solutions":["Review any custom CertificateOpts functions for values that produce invalid certificate fields (e.g. bad extensions, invalid validity ranges).","Retry the generation — transient crypto-stack failures resolve on re-run.","Update the Go toolchain/runtime to a current patch version to rule out a crypto/x509 bug."],"exampleFix":"// before\nopt(certificate) // sets NotBefore after NotAfter\n// after\nopt(certificate) // ensure opts keep NotBefore < NotAfter and valid fields","handlingStrategy":"try-catch","validationCode":"// Verify custom opts keep fields valid:\n// c.NotBefore.Before(c.NotAfter), no duplicate extensions, valid DNS names.","typeGuard":null,"tryCatchPattern":"cert, err := tlsx.CreateSelfSignedCertificate(key, opts...)\nif err != nil && strings.Contains(err.Error(), \"failed to encode private key\") {\n    // misleading message: DER parse failed — audit opts, then retry once\n}","preventionTips":["Audit custom CertificateOpts for fields that could yield an unparseable certificate.","Keep NotBefore < NotAfter and use valid SANs/DNS names in opts.","Pin a current Go patch release to rule out crypto/x509 regressions."],"tags":["tls","x509","crypto","parsing"],"backgroundTag":"x509-certificate-creation-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}