{"record":{"id":"e9bba2bcc01491b2","repo":"dbt-labs/dbt-core","slug":"key-is-pkcs-1-rsa-private-key-snowflake-require","errorCode":null,"errorMessage":"Key is PKCS#1 (RSA private key). Snowflake requires PKCS#8 (-----BEGIN PRIVATE KEY----- or -----BEGIN ENCRYPTED PRIVATE KEY-----).\n\nPossible causes:\n• You ran 'openssl pkcs8 -inform pem -outform der ...' without -topk8\n• You wrapped a PKCS#1 DER with PKCS#8 headers\n• You base64-encoded PEM text and treated it as DER\n\n>   Generate a PKCS#8 key and update your user public key:\nhttps://docs.snowflake.com/en/user-guide/key-pair-auth\nWhile Snowflake recommends 3DES encryption, Fusion recommends using a modern algorithm such as AES-256:\n>   $ openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8","messagePattern":"Key is PKCS#1 \\(RSA private key\\)\\. Snowflake requires PKCS#8 \\(-----BEGIN PRIVATE KEY----- or -----BEGIN ENCRYPTED PRIVATE KEY-----\\)\\.\n\nPossible causes:\n• You ran 'openssl pkcs8 -inform pem -outform der \\.\\.\\.' without -topk8\n• You wrapped a PKCS#1 DER with PKCS#8 headers\n• You base64-encoded PEM text and treated it as DER\n\n>   Generate a PKCS#8 key and update your user public key:\nhttps://docs\\.snowflake\\.com/en/user-guide/key-pair-auth\nWhile Snowflake recommends 3DES encryption, Fusion recommends using a modern algorithm such as AES-256:\n>   \\$ openssl genrsa 2048 \\| openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key\\.p8","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/dbt-auth/src/snowflake/mod.rs","lineNumber":241,"sourceCode":"            }\n            Self::KeypairPath {\n                user,\n                path,\n                passphrase,\n            } => {\n                builder.with_username(user);\n                builder.with_password(ADBC_STUB_PASSWORD);\n                builder.with_named_option(snowflake::AUTH_TYPE, snowflake::auth_type::JWT)?;\n                fs::metadata(path).map_err(|_| {\n                    AuthError::config(format!(\"Private key file not found: '{path}'\"))\n                })?;\n                if let Some(pass) = passphrase {\n                    let key_content = fs::read_to_string(path).map_err(|_| {\n                        AuthError::config(format!(\"Could not read from key file: '{path}'\"))\n                    })?;\n                    let (normalized, status) = key_format::normalize_key(&key_content)?;\n                    if let key_format::SnowflakeKeypairStatus::Warn3Des(msg) = status {\n                        WARN_3DES_KEY_ONCE.call_once(|| warning_printer.warn(msg));\n                    }\n                    builder\n                        .with_named_option(snowflake::JWT_PRIVATE_KEY_PKCS8_VALUE, normalized)?;\n                    builder.with_named_option(snowflake::JWT_PRIVATE_KEY_PKCS8_PASSWORD, pass)?;\n                } else {\n                    builder.with_named_option(snowflake::JWT_PRIVATE_KEY, path)?;\n                }\n            }\n            Self::KeypairInline {\n                user,\n                private_key,\n                passphrase,\n            } => {\n                builder.with_username(user);\n                builder.with_password(ADBC_STUB_PASSWORD);\n                builder.with_named_option(snowflake::AUTH_TYPE, snowflake::auth_type::JWT)?;\n                let (normalized, status) = key_format::normalize_key(private_key)?;\n                if let key_format::SnowflakeKeypairStatus::Warn3Des(msg) = status {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/dbt-labs/dbt-core/blob/0267ce9170576975b76b64ce856b2e5848e96617/crates/dbt-auth/src/snowflake/mod.rs#L223-L259","documentation":"Raised from SnowflakeAuthIR::apply for the KeypairPath variant when a passphrase is supplied: the key file is read and passed through key_format::normalize_key, which rejects keys whose body is PKCS#1 'RSA PRIVATE KEY' rather than PKCS#8. Snowflake key-pair JWT auth requires PKCS#8 encoding (BEGIN PRIVATE KEY / BEGIN ENCRYPTED PRIVATE KEY), so a PKCS#1 key cannot be used to sign the JWT. The error text includes the common openssl mistakes and the recommended regeneration command.","triggerScenarios":"Setting private_key_path (or the inline equivalent) plus private_key_passphrase in a Snowflake profile where the key file contains '-----BEGIN RSA PRIVATE KEY-----' (unencrypted PKCS#1) or a DER/PEM mismatch that resolves to PKCS#1.","commonSituations":"Following old Snowflake docs or blog posts that generate keys with plain 'openssl genrsa'; running 'openssl pkcs8 -inform pem -outform der' without -topk8 (that converts the key body but keeps PKCS#1 structure); wrapping a PKCS#1 DER with PKCS#8 headers by hand; base64-encoding PEM text and saving it as DER.","solutions":["Regenerate the key as PKCS#8: openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8","Update the Snowflake user with the matching public key (ALTER USER ... SET RSA_PUBLIC_KEY=...) per https://docs.snowflake.com/en/user-guide/key-pair-auth","Point private_key_path at the new rsa_key.p8 and keep private_key_passphrase set","If you must keep the existing key, convert in place with: openssl pkcs8 -topk8 -nocrypt -in rsa_key.pem -out rsa_key.p8 (then re-encrypt if a passphrase is needed)"],"exampleFix":"# before\n$ openssl genrsa 2048 | openssl pkcs8 -inform pem -outform der -out rsa_key.der   # no -topk8 => still PKCS#1\n# after\n$ openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8","handlingStrategy":"validation","validationCode":"head -1 \"$PRIVATE_KEY_PATH\" | grep -q 'BEGIN PRIVATE KEY' && echo OK || echo 'PKCS#1 key: regenerate with openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always generate keys with the -topk8 flag and AES-256 encryption","Verify the PEM header is 'BEGIN PRIVATE KEY' or 'BEGIN ENCRYPTED PRIVATE KEY' before committing to profiles.yml","Never base64-encode PEM text as DER or hand-wrap PKCS#1 DER with PKCS#8 headers","Store the generation command in team docs to avoid legacy genrsa-only keys"],"tags":["snowflake","key-pair-auth","openssl","pem","pkcs8"],"backgroundTag":"invalid-argument-format","analyzedSha":"0267ce9170576975b76b64ce856b2e5848e96617","analyzedAt":"2026-09-07T21:53:39.732Z","contentChangedAt":"2026-09-07T21:53:39.732Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}