{"record":{"id":"f32272afe737fd77","repo":"docker/cli","slug":"private-key-is-encrypted-support-for-encrypted-p","errorCode":null,"errorMessage":"private key is encrypted - support for encrypted private keys has been removed, see https://docs.docker.com/go/deprecated/","messagePattern":"private key is encrypted - support for encrypted private keys has been removed, see https://docs\\.docker\\.com/go/deprecated/","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/docker/load.go","lineNumber":67,"sourceCode":"\t}\n\tvar tlsOpts []func(*tls.Config)\n\tif ep.TLSData != nil && ep.TLSData.CA != nil {\n\t\tcertPool := x509.NewCertPool()\n\t\tif !certPool.AppendCertsFromPEM(ep.TLSData.CA) {\n\t\t\treturn nil, errors.New(\"failed to retrieve context tls info: ca.pem seems invalid\")\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.RootCAs = certPool\n\t\t})\n\t}\n\tif ep.TLSData != nil && ep.TLSData.Key != nil && ep.TLSData.Cert != nil {\n\t\tkeyBytes := ep.TLSData.Key\n\t\tpemBlock, _ := pem.Decode(keyBytes)\n\t\tif pemBlock == nil {\n\t\t\treturn nil, errors.New(\"no valid private key found\")\n\t\t}\n\t\tif x509.IsEncryptedPEMBlock(pemBlock) { //nolint:staticcheck // SA1019: x509.IsEncryptedPEMBlock is deprecated, and insecure by design\n\t\t\treturn nil, errors.New(\"private key is encrypted - support for encrypted private keys has been removed, see https://docs.docker.com/go/deprecated/\")\n\t\t}\n\n\t\tx509cert, err := tls.X509KeyPair(ep.TLSData.Cert, keyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to retrieve context tls info: %w\", err)\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.Certificates = []tls.Certificate{x509cert}\n\t\t})\n\t}\n\tif ep.SkipTLSVerify {\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.InsecureSkipVerify = true\n\t\t})\n\t}\n\treturn tlsconfig.ClientDefault(tlsOpts...), nil\n}\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/docker/load.go#L49-L85","documentation":"Returned by Endpoint.tlsConfig when x509.IsEncryptedPEMBlock reports the PEM private key is passphrase-protected (DEK-Info present). Docker removed support for encrypted private keys because they cannot be used unattended (no way to supply a passphrase to the daemon/client automatically), so an encrypted key is explicitly rejected.","triggerScenarios":"Creating a docker context with a TLS key that was generated with a passphrase (e.g. 'openssl genrsa -aes256'). The key has PEM headers like '-----BEGIN ENCRYPTED PRIVATE KEY-----' or contains DEK-Info.","commonSituations":"Reusing an SSH or TLS key generated with a passphrase for Docker context TLS. A security policy mandates encrypted keys, conflicting with Docker's deprecation.","solutions":["Generate or convert an unencrypted PEM key: 'openssl rsa -in encrypted.key -out plain.key'.","Recreate the docker context using the unencrypted key file.","If a passphrase is mandatory by policy, store the context with an unencrypted key protected by filesystem permissions instead."],"exampleFix":"# before\nopenssl genrsa -aes256 -out key.pem 4096\n# after\nopenssl genrsa -out key.pem 4096\nchmod 600 key.pem","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(keyBytes)\nif block != nil && x509.IsEncryptedPEMBlock(block) { //nolint:staticcheck\n    return errors.New(\"encrypted keys are unsupported; decrypt the key first\")\n}","typeGuard":"func isUnencryptedPEMKey(b []byte) bool {\n    block, _ := pem.Decode(b)\n    return block != nil && !x509.IsEncryptedPEMBlock(block) //nolint:staticcheck\n}","tryCatchPattern":null,"preventionTips":["Generate keys without a passphrase.","Convert with 'openssl rsa -in enc.key -out plain.key'.","Protect unencrypted keys with filesystem permissions (chmod 600)."],"tags":["context","tls","private-key","encryption","deprecated"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}