{"record":{"id":"f2fc9166836f5350","repo":"spring-projects/spring-boot","slug":"error-loading-private-key-file","errorCode":null,"errorMessage":"Error loading private key file: {}","messagePattern":"Error loading private key file: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/PemPrivateKeyParser.java","lineNumber":218,"sourceCode":"\t * decryption if necessary.\n\t * @param text the text to parse\n\t * @param password the password used to decrypt an encrypted private key\n\t * @return the parsed private key\n\t */\n\tstatic @Nullable PrivateKey parse(@Nullable String text, @Nullable String password) {\n\t\tif (text == null) {\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tfor (PemParser pemParser : PEM_PARSERS) {\n\t\t\t\tPrivateKey privateKey = pemParser.parse(text, password);\n\t\t\t\tif (privateKey != null) {\n\t\t\t\t\treturn privateKey;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new IllegalStateException(\"Error loading private key file: \" + ex.getMessage(), ex);\n\t\t}\n\t\tthrow new IllegalStateException(\"Missing private key or unrecognized format\");\n\t}\n\n\t/**\n\t * Parser for a specific PEM format.\n\t */\n\tprivate static class PemParser {\n\n\t\tprivate final Pattern pattern;\n\n\t\tprivate final BiFunction<byte[], @Nullable String, PKCS8EncodedKeySpec> keySpecFactory;\n\n\t\tprivate final String[] algorithms;\n\n\t\tPemParser(String header, String footer,\n\t\t\t\tBiFunction<byte[], @Nullable String, PKCS8EncodedKeySpec> keySpecFactory, String... algorithms) {\n\t\t\tthis.pattern = Pattern.compile(header + BASE64_TEXT + footer, Pattern.CASE_INSENSITIVE);","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/spring-projects/spring-boot/blob/270dfe353fb830fd69b823a8a859287ff103854b/buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/PemPrivateKeyParser.java#L200-L236","documentation":"PemPrivateKeyParser.parse(text, password) loops over PEM_PARSERS (PKCS1 RSA, SEC1 EC, PKCS8, encrypted PKCS8). The catch (Exception ex) at line 217 wraps any exception from any parser strategy — DER decode failure, key-spec construction, KeyFactory failure, or the encrypted-key decryptor throwing IllegalArgumentException — into IllegalStateException with the underlying message.","triggerScenarios":"A PEM block matched one of the header regexes, but parsing failed midway: e.g. Pkcs8PrivateKeyDecryptor.decrypt threw IllegalArgumentException because of a wrong password; DerElement parsing hit a malformed ASN.1 structure; KeyFactory.generatePrivate threw InvalidKeySpecException that escaped (note: InvalidKeySpecException inside PemParser.parse is normally swallowed, so an escape here means a different path); createKeySpecForAlgorithm's DerEncoder IO failure.","commonSituations":"Encrypted private key with the wrong password (bubbles up from Pkcs8PrivateKeyDecryptor); DER bytes truncated or corrupted; key algorithm OID not in the ALGORITHMS map combined with a KeyFactory failure.","solutions":["If the key is encrypted, supply the correct password via the parse(text, password) overload.","Re-export the key in unencrypted PKCS8 PEM: `openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem`.","Inspect the wrapped cause for the specific parser error (the message is ex.getMessage())."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate the key with openssl before invoking the build\nProcess p = new ProcessBuilder(\"openssl\", \"pkey\", \"-in\", keyPath.toString(), \"-noout\", \"-passin\", \"pass:\" + pw)\n        .redirectErrorStream(true).start();\nif (p.waitFor() != 0) {\n    throw new IllegalArgumentException(\"Invalid or undecryptable private key at \" + keyPath);\n}","typeGuard":null,"tryCatchPattern":"try {\n    PemPrivateKeyParser.parse(text, password);\n} catch (IllegalStateException ex) {\n    Throwable c = ex.getCause();\n    if (c instanceof IllegalArgumentException iae\n            && iae.getMessage().contains(\"decrypting\")) {\n        // prompt for the correct password and retry\n    } else {\n        // hint: convert key to standard PKCS8 PEM\n    }\n    throw ex;\n}","preventionTips":["Validate private keys with openssl (`openssl pkey -in key.pem -noout`) before the build.","Standardize on unencrypted PKCS8 PEM for build-time keys.","If encryption is required, ensure the password is provisioned through configuration."],"tags":["docker","ssl","private-key","pem","buildpack"],"backgroundTag":null,"analyzedSha":"270dfe353fb830fd69b823a8a859287ff103854b","analyzedAt":"2026-08-11T19:42:06.541Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}