appsmithorg/appsmith · error · Error

The certificate key "${keyFile}" is invalid.\n${err.message}

Error message

The certificate key "${keyFile}" is invalid.\n${err.message}

What it means

Sibling to the cert check in getHttpsConfig.js: validateKeyAndCerts() runs crypto.privateDecrypt(key, encrypted) against the ciphertext produced from the cert. If the private key is malformed, encrypted with a passphrase not supplied here, or does not correspond to the certificate's public key, privateDecrypt throws and the file path is surfaced. Note the pair is validated together, so a cert/key mismatch surfaces here even when both files individually parse.

Source

Thrown at app/client/config/getHttpsConfig.js:26

// Ensure the certificate and key provided are valid and if not
// throw an easy to debug error
function validateKeyAndCerts({ cert, key, keyFile, crtFile }) {
  let encrypted;
  try {
    // publicEncrypt will throw an error with an invalid cert
    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));
  } catch (err) {
    throw new Error(
      `The certificate "${chalk.yellow(crtFile)}" is invalid.\n${err.message}`
    );
  }

  try {
    // privateDecrypt will throw an error with an invalid key
    crypto.privateDecrypt(key, encrypted);
  } catch (err) {
    throw new Error(
      `The certificate key "${chalk.yellow(keyFile)}" is invalid.\n${
        err.message
      }`
    );
  }
}

// Read file and throw an error if it doesn't exist
function readEnvFile(file, type) {
  if (!fs.existsSync(file)) {
    throw new Error(
      `You specified ${chalk.cyan(
        type
      )} in your env, but the file "${chalk.yellow(file)}" can't be found.`
    );
  }
  return fs.readFileSync(file);
}

View on GitHub (pinned to 8cd9021c24)

Solutions

1. Ensure SSL_KEY_FILE is the unencrypted private key paired with SSL_CRT_FILE: 'openssl rsa -in key.pem -check -noout' should pass.
2. If the key has a passphrase, strip it: 'openssl rsa -in enc.pem -out key.pem' (entering the passphrase).
3. Regenerate a matched cert+key pair together so they cannot drift.
4. Verify the modulus matches: 'openssl x509 -in cert.pem -modulus -noout | openssl md5' equals 'openssl rsa -in key.pem -modulus -noout | openssl md5'.

Example fix

# before
SSL_CRT_FILE=cert.pem SSL_KEY_FILE=encrypted-key.pem HTTPS=true npm start
# -> The certificate key "encrypted-key.pem" is invalid.

# after
openssl rsa -in encrypted-key.pem -out key.pem
SSL_CRT_FILE=cert.pem SSL_KEY_FILE=key.pem HTTPS=true npm start

const { execSync } = require('child_process');
function keyMatchesCert(certFile, keyFile) {
  const certMd5 = execSync(`openssl x509 -in "${certFile}" -modulus -noout | openssl md5`).toString();
  const keyMd5 = execSync(`openssl rsa -in "${keyFile}" -modulus -noout | openssl md5`).toString();
  return certMd5.trim() === keyMd5.trim();
}

try { getHttpsConfig(); } catch (e) {
  if (/certificate key .* is invalid/i.test(e.message)) { console.error('Regenerate a matched key/cert pair.'); }
  else throw e;
}

When it happens

Trigger: HTTPS=true with SSL_KEY_FILE that is invalid PEM, is the wrong key for the supplied cert, is encrypted with a passphrase (this code path supplies none), or is a public key file instead of a private key.

Common situations: Cert regenerated but SSL_KEY_FILE still points at an old key; key protected by a passphrase that the dev server cannot unlock; pointing SSL_KEY_FILE at the cert by mistake; key generated as PKCS#8 encrypted while cert expects an unencrypted RSA key.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The certificate "${crtFile}" is invalid.\n${err.message}
• You specified ${type} in your env, but the file "${file}" ca
• The ${path} path must start with 'https://'.

AI-assisted analysis of appsmithorg/appsmith@8cd9021c24 (2026-08-12). Data as JSON: /api/errors/d0d0d51f8de14ee2. Report an issue: GitHub.