{"record":{"id":"e9a9a171de1e7de2","repo":"denoland/deno","slug":"err-crypto-incompatible-key-options","errorCode":"ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS","errorMessage":"The selected key encoding ${typeStr} can only be used for RSA keys.","messagePattern":"The selected key encoding (.+?) can only be used for RSA keys\\.","errorType":"exception","errorClass":"ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/keygen.ts","lineNumber":240,"sourceCode":"    return \"der\";\n  } else if (formatStr === \"jwk\") {\n    return \"jwk\";\n  }\n  throw new ERR_INVALID_ARG_VALUE(optionName, formatStr);\n}\n\nfunction parseKeyType(\n  typeStr: string | undefined,\n  required: boolean,\n  keyType: string | undefined,\n  isPublic: boolean | undefined,\n  optionName: string,\n): string | undefined {\n  if (typeStr === undefined && !required) {\n    return undefined;\n  } else if (typeStr === \"pkcs1\") {\n    if (keyType !== undefined && keyType !== \"rsa\") {\n      throw new ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(\n        typeStr,\n        \"can only be used for RSA keys\",\n      );\n    }\n    return \"pkcs1\";\n  } else if (typeStr === \"spki\" && isPublic !== false) {\n    return \"spki\";\n  } else if (typeStr === \"pkcs8\" && isPublic !== true) {\n    return \"pkcs8\";\n  } else if (typeStr === \"sec1\" && isPublic !== true) {\n    if (keyType !== undefined && keyType !== \"ec\") {\n      throw new ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(\n        typeStr,\n        \"can only be used for EC keys\",\n      );\n    }\n    return \"sec1\";\n  }","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/keygen.ts#L222-L258","documentation":"In key-pair encoding options, type 'pkcs1' is an RSA-only encoding. parseKeyType (ext/node/polyfills/internal/crypto/keygen.ts:235-244) checks the keyType it was given and, when the pair being generated is anything other than 'rsa', throws ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS ('can only be used for RSA keys'). pkcs1 (RFC 8017) defines RSA public/private key syntax, so this is a structural mismatch, not a preference.","triggerScenarios":"generateKeyPairSync('ed25519' | 'ec' | 'dsa' | 'rsa-pss', { privateKeyEncoding: { type: 'pkcs1', format: 'pem' } }); reusing an RSA-oriented encoding config for every key type in a multi-algorithm service.","commonSituations":"Copy-pasting an options block between RSA and EC/Ed25519 generators; config templates with a fixed privateKeyEncoding.type; wrapping generateKeyPairSync behind a generic helper that ignores the algorithm when building encoding options.","solutions":["For EC keys use type 'sec1' (private) / 'spki' (public); for Ed25519 and most private keys use 'pkcs8'.","Make the encoding type follow the algorithm in config: rsa->pkcs1, ec->sec1, everything else->pkcs8/spki.","Drop the type option entirely where a safe default exists for your format."],"exampleFix":"// before\ncrypto.generateKeyPairSync('ed25519', {\n  privateKeyEncoding: { type: 'pkcs1', format: 'pem' }, // pkcs1 is RSA-only\n});\n\n// after\ncrypto.generateKeyPairSync('ed25519', {\n  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n});","handlingStrategy":"validation","validationCode":"const PRIVATE_TYPE_BY_ALG = {\n  rsa: 'pkcs1', 'rsa-pss': 'pkcs8', ec: 'sec1', ed25519: 'pkcs8', dsa: 'pkcs8',\n};\nconst enc = { format: 'pem', type: PRIVATE_TYPE_BY_ALG[alg] };\nif (enc.type === 'pkcs1' && alg !== 'rsa') {\n  throw new Error(`pkcs1 cannot encode ${alg} keys`);\n}","typeGuard":"function privateKeyTypeFor(alg) {\n  if (alg === 'rsa') return 'pkcs1';\n  if (alg === 'ec') return 'sec1';\n  return 'pkcs8'; // safe default for ed25519, rsa-pss, dsa, ...\n}","tryCatchPattern":"try {\n  crypto.generateKeyPairSync(alg, { privateKeyEncoding: { type: 'pkcs1', format: 'pem' } });\n} catch (e) {\n  if (e.code === 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS') {\n    return crypto.generateKeyPairSync(alg, {\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n    });\n  }\n  throw e;\n}","preventionTips":["Never reuse one hardcoded encoding block across algorithms.","Derive encoding type from the algorithm in your config model.","When unsure, pkcs8/spki accept nearly every key type."],"tags":["crypto","key-generation","key-encoding","pkcs1","node-compat"],"backgroundTag":"incompatible-key-options","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}