{"record":{"id":"ceab5a11477d1674","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-update-private-key-no-such-private-key-was","errorCode":null,"errorMessage":"Cannot update private key: no such private key was found.","messagePattern":"Cannot update private key: no such private key was found\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimaryZone.cs","lineNumber":1080,"sourceCode":"\n        public void AddPrivateKey(DnssecPrivateKey privateKey)\n        {\n            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)\n                throw new DnsServerException(\"The primary zone must be signed.\");\n\n            lock (_dnssecPrivateKeys)\n            {\n                if (!_dnssecPrivateKeys.TryAdd(privateKey.KeyTag, privateKey))\n                    throw new DnsServerException($\"Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")} private key: key tag collision. Please generate another private key and try again.\");\n            }\n        }\n\n        public DnssecPrivateKey UpdatePrivateKey(ushort keyTag, ushort rolloverDays)\n        {\n            lock (_dnssecPrivateKeys)\n            {\n                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))\n                    throw new DnsServerException(\"Cannot update private key: no such private key was found.\");\n\n                privateKey.RolloverDays = rolloverDays;\n\n                return privateKey;\n            }\n        }\n\n        public void DeletePrivateKey(ushort keyTag)\n        {\n            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)\n                throw new DnsServerException(\"The zone must be signed.\");\n\n            lock (_dnssecPrivateKeys)\n            {\n                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))\n                    throw new DnsServerException(\"Cannot delete private key: no such private key was found.\");\n\n                if (privateKey.State != DnssecPrivateKeyState.Generated)","sourceCodeStart":1062,"sourceCodeEnd":1098,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimaryZone.cs#L1062-L1098","documentation":"Thrown by UpdatePrivateKey when _dnssecPrivateKeys.TryGetValue fails for the supplied keyTag. The dictionary is keyed by KeyTag, so an unknown tag cannot be updated.","triggerScenarios":"Calling UpdatePrivateKey(keyTag, rolloverDays) with a keyTag that is not present in the zone's private key set.","commonSituations":"Passing a stale keyTag from an older config, a UI form bug sending 0, or a race where the key was deleted between listing and updating.","solutions":["List the zone's DnssecPrivateKeys and confirm the keyTag exists before updating.","If the key was removed, regenerate or re-add it instead of updating.","Validate that the keyTag returned by a prior Generate/Add call is the one you pass."],"exampleFix":"// before\nzone.UpdatePrivateKey(keyTag, rolloverDays: 365);\n\n// after\nvar keys = zone.DnssecPrivateKeys;\nvar match = keys.FirstOrDefault(k => k.KeyTag == keyTag);\nif (match is null)\n    throw new ArgumentException($\"No private key with KeyTag {keyTag}.\");\nzone.UpdatePrivateKey(keyTag, rolloverDays: 365);","handlingStrategy":"validation","validationCode":"// Verify the keyTag exists before updating\nvar key = zone.DnssecPrivateKeys.FirstOrDefault(k => k.KeyTag == keyTag);\nif (key is null)\n    throw new ArgumentException($\"No private key with KeyTag {keyTag}.\");\nzone.UpdatePrivateKey(keyTag, rolloverDays);","typeGuard":"static bool KeyTagExists(ApexZone zone, ushort keyTag) =>\n    zone.DnssecPrivateKeys.Any(k => k.KeyTag == keyTag);","tryCatchPattern":"try\n{\n    zone.UpdatePrivateKey(keyTag, rolloverDays);\n}\ncatch (DnsServerException ex) when (ex.Message.Contains(\"no such private key was found\"))\n{\n    // refresh the key list; the tag is stale or from another zone\n}","preventionTips":["Always use the KeyTag returned by the generate/add call, not a hand-typed value.","Re-fetch the key listing before applying user-driven updates."],"tags":["dnssec","private-key","validation","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}