{"record":{"id":"d0d0d51f8de14ee2","repo":"appsmithorg/appsmith","slug":"the-certificate-key-keyfile-is-invalid-n-er","errorCode":null,"errorMessage":"The certificate key \"${keyFile}\" is invalid.\\n${err.message}","messagePattern":"The certificate key \"(.+?)\" is invalid\\.\\\\n(.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"app/client/config/getHttpsConfig.js","lineNumber":26,"sourceCode":"\n// Ensure the certificate and key provided are valid and if not\n// throw an easy to debug error\nfunction validateKeyAndCerts({ cert, key, keyFile, crtFile }) {\n  let encrypted;\n  try {\n    // publicEncrypt will throw an error with an invalid cert\n    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));\n  } catch (err) {\n    throw new Error(\n      `The certificate \"${chalk.yellow(crtFile)}\" is invalid.\\n${err.message}`\n    );\n  }\n\n  try {\n    // privateDecrypt will throw an error with an invalid key\n    crypto.privateDecrypt(key, encrypted);\n  } catch (err) {\n    throw new Error(\n      `The certificate key \"${chalk.yellow(keyFile)}\" is invalid.\\n${\n        err.message\n      }`\n    );\n  }\n}\n\n// Read file and throw an error if it doesn't exist\nfunction readEnvFile(file, type) {\n  if (!fs.existsSync(file)) {\n    throw new Error(\n      `You specified ${chalk.cyan(\n        type\n      )} in your env, but the file \"${chalk.yellow(file)}\" can't be found.`\n    );\n  }\n  return fs.readFileSync(file);\n}","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/appsmithorg/appsmith/blob/8cd9021c24cdbea1c3c12c966073708e83db60c2/app/client/config/getHttpsConfig.js#L8-L44","documentation":"Sibling to the cert check in getHttpsConfig.js: validateKeyAndCerts() runs crypto.privateDecrypt(key, encrypted) against the ciphertext produced from the cert. If the private key is malformed, encrypted with a passphrase not supplied here, or does not correspond to the certificate's public key, privateDecrypt throws and the file path is surfaced. Note the pair is validated together, so a cert/key mismatch surfaces here even when both files individually parse.","triggerScenarios":"HTTPS=true with SSL_KEY_FILE that is invalid PEM, is the wrong key for the supplied cert, is encrypted with a passphrase (this code path supplies none), or is a public key file instead of a private key.","commonSituations":"Cert regenerated but SSL_KEY_FILE still points at an old key; key protected by a passphrase that the dev server cannot unlock; pointing SSL_KEY_FILE at the cert by mistake; key generated as PKCS#8 encrypted while cert expects an unencrypted RSA key.","solutions":["Ensure SSL_KEY_FILE is the unencrypted private key paired with SSL_CRT_FILE: 'openssl rsa -in key.pem -check -noout' should pass.","If the key has a passphrase, strip it: 'openssl rsa -in enc.pem -out key.pem' (entering the passphrase).","Regenerate a matched cert+key pair together so they cannot drift.","Verify the modulus matches: 'openssl x509 -in cert.pem -modulus -noout | openssl md5' equals 'openssl rsa -in key.pem -modulus -noout | openssl md5'."],"exampleFix":"# before\nSSL_CRT_FILE=cert.pem SSL_KEY_FILE=encrypted-key.pem HTTPS=true npm start\n# -> The certificate key \"encrypted-key.pem\" is invalid.\n\n# after\nopenssl rsa -in encrypted-key.pem -out key.pem\nSSL_CRT_FILE=cert.pem SSL_KEY_FILE=key.pem HTTPS=true npm start","handlingStrategy":"validation","validationCode":"const { execSync } = require('child_process');\nfunction keyMatchesCert(certFile, keyFile) {\n  const certMd5 = execSync(`openssl x509 -in \"${certFile}\" -modulus -noout | openssl md5`).toString();\n  const keyMd5 = execSync(`openssl rsa -in \"${keyFile}\" -modulus -noout | openssl md5`).toString();\n  return certMd5.trim() === keyMd5.trim();\n}","typeGuard":null,"tryCatchPattern":"try { getHttpsConfig(); } catch (e) {\n  if (/certificate key .* is invalid/i.test(e.message)) { console.error('Regenerate a matched key/cert pair.'); }\n  else throw e;\n}","preventionTips":["Always generate cert and key together so they cannot drift.","Strip passphrases from dev keys: 'openssl rsa -in enc.pem -out key.pem'.","Verify modulus equality before pointing the dev server at the files."],"tags":["https","tls","certificates","private-key","dev-server"],"backgroundTag":null,"analyzedSha":"8cd9021c24cdbea1c3c12c966073708e83db60c2","analyzedAt":"2026-08-12T22:14:19.293Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}