{"record":{"id":"dbb58ba59ee3a8fe","repo":"pentaho/pentaho-kettle","slug":"failed-to-load-ssh-key","errorCode":null,"errorMessage":"Failed to load SSH key","messagePattern":"Failed to load SSH key","errorType":"exception","errorClass":"SshAuthenticationException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/core/ssh/mina/MinaSshConnection.java","lineNumber":320,"sourceCode":"      log( DEBUG, \"Skipping public key authentication - not configured\" );\n      return false;\n    }\n\n    log( DEBUG, \"Attempting SSH public key authentication\" );\n\n    try {\n      KeyPairProvider keyPairProvider = loadKeyPairProvider();\n      if ( keyPairProvider == null ) {\n        return false;\n      }\n\n      configurePassphrase( keyPairProvider );\n      loadKeysIntoSession( keyPairProvider );\n\n      return performPublicKeyAuth();\n    } catch ( IOException | GeneralSecurityException e ) {\n      log( ERROR, \"SSH public key authentication error: \" + e.getMessage(), e );\n      throw new SshAuthenticationException( \"Failed to load SSH key\", e );\n    }\n  }\n\n  private KeyPairProvider loadKeyPairProvider() {\n    if ( config.getKeyContent() != null ) {\n      log( DEBUG, \"Using in-memory SSH key content\" );\n      return createInMemoryKeyProvider( config.getKeyContent() );\n    }\n\n    if ( config.getKeyPath() != null ) {\n      log( DEBUG, \"Loading SSH key from file: \" + config.getKeyPath() );\n      Path key = config.getKeyPath();\n      if ( !Files.exists( key ) ) {\n        log( ERROR, \"SSH key file does not exist: \" + key );\n        return null;\n      }\n      return new FileKeyPairProvider( List.of( key ) );\n    }","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/core/ssh/mina/MinaSshConnection.java#L302-L338","documentation":"tryPublicKeyAuthentication wraps any IOException or GeneralSecurityException from loading/using the key pair into SshAuthenticationException('Failed to load SSH key'). The private key material could not be read, decrypted, or parsed before authentication could even be attempted.","triggerScenarios":"Key content (in-memory) or key file is malformed/unsupported format, the passphrase is wrong or missing for an encrypted key, or the key file path is unreadable — raised inside loadKeysIntoSession/KeyPairProvider usage.","commonSituations":"PEM vs OpenSSH new-format keys not supported by the bundled SSHD version; wrong passphrase; key file permissions; empty key content field in the connection dialog; PKCS#8/PPK formats.","solutions":["Verify the key file exists, is readable, and is a supported format (OpenSSH/PEM, not PuTTY .ppk)","Correct the passphrase — an encrypted key needs its passphrase in config","Convert the key: ssh-keygen -p -m PEM -f id_rsa if the parser rejects the format","If using key content, paste the full key including BEGIN/END header lines","Upgrade the SSHD library if the key uses a newer format (e.g. ed25519-sk)"],"exampleFix":"// before\nconfig.setKeyContent( Files.readString( Path.of( \"id_rsa\" ) ).trim() ); // header stripped breaks parse\n// after\nconfig.setKeyContent( Files.readString( Path.of( \"id_rsa\" ) ) ); // keep full PEM including BEGIN/END lines","handlingStrategy":"validation","validationCode":"// validate key before connect()\nString key = config.getKeyContent() != null ? config.getKeyContent() : Files.readString( Path.of( keyPath ) );\nif ( !key.contains( \"BEGIN\" ) || !key.contains( \"PRIVATE KEY\" ) ) {\n  throw new IllegalArgumentException( \"Key is not a valid PEM/OpenSSH private key\" );\n}\nif ( key.contains( \"ENCRYPTED\" ) && ( config.getPassphrase() == null || config.getPassphrase().isEmpty() ) ) {\n  throw new IllegalArgumentException( \"Key is encrypted but no passphrase configured\" );\n}","typeGuard":null,"tryCatchPattern":"try { conn.connect(); }\ncatch ( SshAuthenticationException e ) {\n  if ( e.getMessage().contains( \"Failed to load SSH key\" ) ) {\n    log.error( \"Key load failed: check format (PEM/OpenSSH, not .ppk), passphrase, and file readability\", e.getCause() );\n  } else throw e;\n}","preventionTips":["Use ssh-keygen -p -m PEM to convert keys the parser rejects","Never paste .ppk files; convert PuTTY keys to OpenSSH format first","Store the passphrase alongside the key config when keys are encrypted","Check key file permissions (readable by the Pentaho process user)"],"tags":["ssh","key","authentication","file"],"backgroundTag":"file-read-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}