{"record":{"id":"cd28b9cf42c06627","repo":"nautechsystems/nautilus_trader","slug":"no-valid-private-key-found-in","errorCode":null,"errorMessage":"No valid private key found in {}","messagePattern":"No valid private key found in (.+?)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/network/src/tls.rs","lineNumber":205,"sourceCode":"}\n\nfn load_private_key(path: &Path) -> anyhow::Result<PrivateKeyDer<'static>> {\n    let file = File::open(path)?;\n    if let Some(key) = PrivatePkcs8KeyDer::pem_reader_iter(file).find_map(Result::ok) {\n        return Ok(key.into());\n    }\n\n    let file = File::open(path)?;\n    if let Some(key) = PrivatePkcs1KeyDer::pem_reader_iter(file).find_map(Result::ok) {\n        return Ok(key.into());\n    }\n\n    let file = File::open(path)?;\n    if let Some(key) = PrivateSec1KeyDer::pem_reader_iter(file).find_map(Result::ok) {\n        return Ok(key.into());\n    }\n\n    anyhow::bail!(\"No valid private key found in {}\", path.display());\n}\n\nfn load_certs(path: &Path) -> anyhow::Result<Vec<CertificateDer<'static>>> {\n    let file = File::open(path)?;\n    let certs = CertificateDer::pem_reader_iter(file)\n        .filter_map(std::result::Result::ok)\n        .collect();\n    Ok(certs)\n}\n\n#[cfg(test)]\nmod tests {\n    use std::{io::Cursor, sync::Arc};\n\n    use rstest::rstest;\n    use rustls::{\n        ClientConnection, Connection, ServerConnection,\n        pki_types::{PrivatePkcs1KeyDer, PrivatePkcs8KeyDer, PrivateSec1KeyDer, ServerName},","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/network/src/tls.rs#L187-L223","documentation":"load_private_key opens the PEM file at path and tries to parse a SEC1/EC private key block; if the file yields no valid private key it bails. The message includes the path so the offending key file can be located quickly.","triggerScenarios":"create_tls_config_from_certs_dir (or tests) calling load_private_key on a file that is empty, contains only certificates, has a malformed/truncated PEM block, or a key format the parser does not support (e.g. encrypted PKCS#8 with unsupported settings).","commonSituations":"Passing the certificate file where the key file is expected; key file truncated during copy/secret mount; concatenated multi-key files with the first block malformed; keys generated in an unsupported encoding.","solutions":["Verify the file actually contains a private key PEM block (-----BEGIN PRIVATE KEY----- / -----BEGIN EC PRIVATE KEY-----).","Regenerate the key in a supported, unencrypted format (openssl ecparam / openssl genpkey without encryption).","Check you passed the key path, not the cert path, to the loader.","Inspect the file for truncation/corruption (openssl pkey -in file -check)."],"exampleFix":"// before\nlet key = load_private_key(Path::new(\"/etc/certs/ca.pem\"))?; // wrong file\n// after\nlet key = load_private_key(Path::new(\"/etc/certs/client.key\"))?;","handlingStrategy":"validation","validationCode":"// Rust: pre-validate the key file contains a PEM block\nlet text = std::fs::read_to_string(path)?;\nif !text.contains(\"PRIVATE KEY\") {\n    return Err(anyhow::anyhow!(\"no private key block in {}\", path.display()));\n}","typeGuard":"fn pem_file_contains_key(path: &std::path::Path) -> bool {\n    std::fs::read_to_string(path).map(|t| t.contains(\"PRIVATE KEY\")).unwrap_or(false)\n}","tryCatchPattern":"let key = load_private_key(path)\n    .map_err(|e| { log::error!(\"key load failed: {e}\"); e })?;","preventionTips":["Pass the key file, not the cert file, to key loaders.","Generate keys in supported unencrypted PEM formats.","Verify keys with `openssl pkey -in file -check` after provisioning.","Watch for truncation when copying keys through secret managers."],"tags":["rust","tls","pem","private-key","filesystem"],"backgroundTag":"invalid-argument-value","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}