encrypted private keys are not supported; please decrypt the

Error message

encrypted private keys are not supported; please decrypt the key first

What it means

Error "encrypted private keys are not supported; please decrypt the key first" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/storageloader.go:97

		certData, err := sl.storage.Load(sl.ctx, pair.Certificate)
		if err != nil {
			return nil, err
		}
		keyData, err := sl.storage.Load(sl.ctx, pair.Key)
		if err != nil {
			return nil, err
		}

		var cert tls.Certificate
		switch pair.Format {
		case "":
			fallthrough

		case "pem":
			// if the start of the key file looks like an encrypted private key,
			// reject it with a helpful error message
			if strings.Contains(string(keyData[:40]), "ENCRYPTED") {
				return nil, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
			}

			cert, err = tls.X509KeyPair(certData, keyData)

		default:
			return nil, fmt.Errorf("unrecognized certificate/key encoding format: %s", pair.Format)
		}
		if err != nil {
			return nil, err
		}

		certs = append(certs, Certificate{Certificate: cert, Tags: pair.Tags})
	}
	return certs, nil
}

// Interface guard
var (

View on GitHub (pinned to 50e54ee279)

Solutions

Decrypt the private key first, e.g. with 'openssl rsa -in key.pem -out key-decrypted.pem', then store the decrypted key.

When it happens

Trigger: Thrown at modules/caddytls/storageloader.go:97 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/94b7fb8b3185f0d7. Report an issue: GitHub.