{"record":{"id":"f88bdc16837ea7b0","repo":"kubernetes/kops","slug":"error-writing-ssl-privatekey-v","errorCode":null,"errorMessage":"error writing SSL PrivateKey: %v","messagePattern":"error writing SSL PrivateKey: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/privatekey.go","lineNumber":102,"sourceCode":"\n\tvar data bytes.Buffer\n\t_, err := k.WriteTo(&data)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error writing SSL private key: %v\", err)\n\t}\n\treturn data.String(), nil\n}\n\nfunc (k *PrivateKey) AsBytes() ([]byte, error) {\n\t// Nicer behaviour because this is called from templates\n\tif k == nil {\n\t\treturn nil, fmt.Errorf(\"AsBytes called on nil private key\")\n\t}\n\n\tvar data bytes.Buffer\n\t_, err := k.WriteTo(&data)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error writing SSL PrivateKey: %v\", err)\n\t}\n\treturn data.Bytes(), nil\n}\n\nfunc (k *PrivateKey) UnmarshalJSON(b []byte) (err error) {\n\ts := \"\"\n\tif err := json.Unmarshal(b, &s); err == nil {\n\t\tr, err := parsePEMPrivateKey([]byte(s))\n\t\tif err != nil {\n\t\t\t// Alternative form: Check if base64 encoded\n\t\t\t// TODO: Do we need this?  I think we need this only on nodeup, but maybe we could just not base64-it?\n\t\t\td, err2 := base64.StdEncoding.DecodeString(s)\n\t\t\tif err2 == nil {\n\t\t\t\tr2, err2 := parsePEMPrivateKey(d)\n\t\t\t\tif err2 == nil {\n\t\t\t\t\tklog.Warningf(\"used base64 decode of PrivateKey\")\n\t\t\t\t\tr = r2\n\t\t\t\t\terr = nil","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/privatekey.go#L84-L120","documentation":"AsBytes() wraps any failure from PrivateKey.WriteTo() when serializing the key into a PEM bytes.Buffer. The underlying error is almost always an encoding failure reported by WriteTo (e.g. unknown key type); this message just contextualizes it for callers writing SSL private keys.","triggerScenarios":"Calling AsBytes() on a PrivateKey whose Key field is a crypto.Signer that is neither *rsa.PrivateKey nor *ecdsa.PrivateKey (e.g. ed25519 from a PKCS8 parse), causing WriteTo to fail with 'unknown private key type'.","commonSituations":"Storing keys parsed from PKCS8 'PRIVATE KEY' PEM blocks using ed25519, then serializing via AsBytes; using keys generated by other tooling with unsupported algorithms; template rendering of certificates/secrets that embeds the key.","solutions":["Inspect the wrapped error: if it says 'unknown private key type: %T', the key algorithm is unsupported — convert or regenerate as RSA/ECDSA.","Regenerate the key with pki.GeneratePrivateKey() (RSA) so WriteTo can encode it.","If the key must be preserved, convert the signer to an RSA or ECDSA key before storing it in PrivateKey.Key."],"exampleFix":"// before (ed25519 key from PKCS8)\nout, _ := key.AsBytes()\n// after\nswitch key.Key.(type) {\ncase *rsa.PrivateKey, *ecdsa.PrivateKey:\n    out, err := key.AsBytes()\n    if err != nil { return err }\ndefault:\n    return fmt.Errorf(\"unsupported key type; regenerate as RSA or ECDSA\")\n}","handlingStrategy":"validation","validationCode":"switch key.Key.(type) {\ncase *rsa.PrivateKey, *ecdsa.PrivateKey:\n    // ok\ndefault:\n    return fmt.Errorf(\"unsupported private key type %T\", key.Key)\n}","typeGuard":"func isSerializableKey(k *pki.PrivateKey) bool {\n    if k == nil { return false }\n    switch k.Key.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":"b, err := key.AsBytes()\nif err != nil {\n    var unsupported = strings.Contains(err.Error(), \"unknown private key type\")\n    // regenerate or convert key if unsupported\n    return fmt.Errorf(\"AsBytes: %w\", err)\n}","preventionTips":["Only store *rsa.PrivateKey or *ecdsa.PrivateKey in PrivateKey.Key.","Prefer generating keys with pki.GeneratePrivateKey() over importing foreign key material.","Log %T of the key when serialization fails to identify unsupported algorithms."],"tags":["pki","serialization","private-key"],"backgroundTag":"private-key-encoding-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}