encrypted private keys are not supported; please decrypt the

Error message

encrypted private keys are not supported; please decrypt the key first

What it means

Error "encrypted private keys are not supported; please decrypt the key first" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/folderloader.go:166

				foundKey = true
			}
		} else {
			return tls.Certificate{}, fmt.Errorf("unrecognized PEM block type: %s", derBlock.Type)
		}
	}

	certPEMBytes, keyPEMBytes := certBuilder.Bytes(), keyBuilder.Bytes()
	if len(certPEMBytes) == 0 {
		return tls.Certificate{}, fmt.Errorf("failed to parse PEM data")
	}
	if len(keyPEMBytes) == 0 {
		return tls.Certificate{}, fmt.Errorf("no private key block found")
	}

	// if the start of the key file looks like an encrypted private key,
	// reject it with a helpful error message
	if strings.HasPrefix(string(keyPEMBytes[:40]), "ENCRYPTED") {
		return tls.Certificate{}, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
	}

	cert, err := tls.X509KeyPair(certPEMBytes, keyPEMBytes)
	if err != nil {
		return tls.Certificate{}, fmt.Errorf("making X509 key pair: %v", err)
	}

	return cert, nil
}

var (
	_ CertificateLoader = (FolderLoader)(nil)
	_ caddy.Provisioner = (FolderLoader)(nil)
)

View on GitHub (pinned to 50e54ee279)

Solutions

Decrypt the private key first, e.g. with 'openssl rsa -in key.pem -out key-decrypted.pem', then configure Caddy with the decrypted key.

When it happens

Trigger: Thrown at modules/caddytls/folderloader.go:166 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/4553a772692cc00d. Report an issue: GitHub.