{"record":{"id":"e0995e7b457dd8ac","repo":"dgraph-io/dgraph","slug":"failed-to-read-key-block","errorCode":null,"errorMessage":"Failed to read key block","messagePattern":"Failed to read key block","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/create.go","lineNumber":105,"sourceCode":"\t\t\tType:  \"RSA PRIVATE KEY\",\n\t\t\tBytes: x509.MarshalPKCS1PrivateKey(k),\n\t\t})\n\t}\n\treturn nil, errors.Errorf(\"Unsupported key type: %T\", key)\n}\n\n// readKey tries to read and decode the contents of a private key file.\n// Returns the private key, or error otherwise.\nfunc readKey(keyFile string) (crypto.PrivateKey, error) {\n\tb, err := os.ReadFile(keyFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, _ := pem.Decode(b)\n\tswitch {\n\tcase block == nil:\n\t\treturn nil, errors.Errorf(\"Failed to read key block\")\n\tcase block.Type == \"EC PRIVATE KEY\":\n\t\treturn x509.ParseECPrivateKey(block.Bytes)\n\tcase block.Type == \"RSA PRIVATE KEY\":\n\t\treturn x509.ParsePKCS1PrivateKey(block.Bytes)\n\t}\n\treturn nil, errors.Errorf(\"Unknown PEM type: %s\", block.Type)\n}\n\n// readCert tries to read and decode the contents of a signed cert file.\n// Returns the x509v3 cert, or error otherwise.\nfunc readCert(certFile string) (*x509.Certificate, error) {\n\tb, err := os.ReadFile(certFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, _ := pem.Decode(b)\n\tswitch {","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/create.go#L87-L123","documentation":"readKey (dgraph/cmd/cert/create.go:105) fails when pem.Decode returns no block, i.e. the key file's bytes are not valid PEM at all (no BEGIN/END block). The tool cannot decode a private key from the file and aborts. This is a defensive error distinguishing 'not PEM' from 'wrong PEM type' (Unknown PEM type).","triggerScenarios":"Calling readKey (via makeKey/getFileInfo/createNodePair/createClientPair) on a key file that is empty, truncated, DER/binary-encoded instead of PEM, contains only junk text, or whose PEM headers are corrupted.","commonSituations":"Pointing --key (or tls_key config) at the certificate file or a config file by mistake; key file truncated by a failed transfer; using DER-format keys exported from other tools; empty file created by a previous failed run.","solutions":["Verify the file starts with -----BEGIN ... PRIVATE KEY----- (`head -1 <keyfile>`); fix the path if not.","Regenerate the key pair with `dgraph cert --node --force` or `--client --force` if the file is corrupted or empty.","Convert a DER key to PEM: `openssl rsa -inform DER -in key.der -out key.pem`.","Check file permissions/size — a zero-byte file means a prior creation failed."],"exampleFix":"// before (wrong file, this is a cert)\nkeyFile := \"ca.crt\"          // contains -----BEGIN CERTIFICATE-----\n// after (correct key file)\nkeyFile := \"ca.key\"          // contains -----BEGIN RSA/EC PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"b, err := os.ReadFile(keyFile)\nif err != nil { return err }\nif len(bytes.TrimSpace(b)) == 0 {\n    return fmt.Errorf(\"key file %s is empty\", keyFile)\n}\nif !bytes.Contains(b, []byte(\"-----BEGIN\")) {\n    return fmt.Errorf(\"key file %s is not PEM encoded\", keyFile)\n}","typeGuard":"func isPEMKey(data []byte) bool {\n    block, _ := pem.Decode(data)\n    return block != nil && strings.HasSuffix(block.Type, \"PRIVATE KEY\")\n}","tryCatchPattern":"key, err := readKey(keyFile)\nif err != nil {\n    if err.Error() == \"Failed to read key block\" {\n        return fmt.Errorf(\"%s is not a PEM file; check path and regenerate keys\", keyFile)\n    }\n    return err\n}","preventionTips":["Confirm the key path points at a .key/.pem file, not a .crt or config file.","Check `head -1` of the key file for a -----BEGIN block before use.","Copy keys with rsync/scp and verify checksums to avoid truncation.","Never hand-edit key files; regenerate with `dgraph cert --force` if damaged."],"tags":["pem","tls","key-file","parsing"],"backgroundTag":"invalid-pem-block","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}