{"record":{"id":"d49f5538d35591a5","repo":"SonarSource/sonarqube","slug":"the-github-app-private-key-is-not-valid","errorCode":null,"errorMessage":"The Github App private key is not valid","messagePattern":"The Github App private key is not valid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/security/GithubAppSecurityImpl.java","lineNumber":100,"sourceCode":"      PrivateKey privateKey = keyFactory.generatePrivate(keySpec1);\n      return Algorithm.RSA256(new RSAKeyProvider() {\n        @Override\n        public RSAPublicKey getPublicKeyById(String keyId) {\n          throw new UnsupportedOperationException(\"getPublicKeyById not implemented\");\n        }\n\n        @Override\n        public RSAPrivateKey getPrivateKey() {\n          return (RSAPrivateKey) privateKey;\n        }\n\n        @Override\n        public String getPrivateKeyId() {\n          return \"github_app_\" + appId;\n        }\n      });\n    } catch (Exception e) {\n      throw new IllegalArgumentException(\"The Github App private key is not valid\", e);\n    } finally {\n      Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);\n    }\n  }\n\n}\n","sourceCodeStart":82,"sourceCodeEnd":107,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/security/GithubAppSecurityImpl.java#L82-L107","documentation":"Thrown by GithubAppSecurityImpl.readApplicationPrivateKey when constructing the RSA256 JWT signing algorithm fails for any reason (bad PKCS8 spec, invalid RSA key material, provider errors). It wraps the underlying exception as an IllegalArgumentException.","triggerScenarios":"readApplicationPrivateKey (via algorithm) parses a PEM block successfully but KeyFactory.getInstance(\"RSA\").generatePrivate(...) throws (malformed DER, unsupported key format like OpenSSH or PKCS1), or Algorithm.RSA256 setup fails.","commonSituations":"User uploaded a PKCS#1 'BEGIN RSA PRIVATE KEY' key, an encrypted key, or an SSH-format key; key file corrupted; wrong key copied (not the GitHub App's .pem).","solutions":["Convert the key to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key_pkcs8.pem and reconfigure","Re-download the GitHub App .pem private key and paste it unchanged","Check the underlying wrapped exception (getCause) for the exact crypto failure"],"exampleFix":"// before: -----BEGIN RSA PRIVATE KEY----- (PKCS#1, unsupported parse path)\n// after: openssl pkcs8 -topk8 -nocrypt -in app-key.pem -> -----BEGIN PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"openssl pkcs8 -topk8 -nocrypt -in app-private-key.pem -out app-private-key.pkcs8.pem  # run before uploading","typeGuard":null,"tryCatchPattern":"try { githubAppSecurity.algorithm(appId, key); } catch (IllegalArgumentException e) { inspect(e.getCause()); // underlying crypto failure\n}","preventionTips":["Convert keys to PKCS#8 unencrypted format before configuring","Never use SSH-format or encrypted PEM keys for GitHub Apps","Re-download the .pem from GitHub App settings if parsing fails repeatedly"],"tags":["github","rsa","private-key","jwt"],"backgroundTag":"invalid-config-value","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}