private key type %T does not match issuer public key type %T

Error message

private key type %T does not match issuer public key type %T

What it means

Error "private key type %T does not match issuer public key type %T" thrown in caddyserver/caddy.

Source

Thrown at modules/caddypki/crypto.go:132

				return nil, nil, err
			}
		}

		return chain, key, nil

	default:
		return nil, nil, fmt.Errorf("unsupported format: %s", kp.Format)
	}
}

// verifyKeysMatch verifies that the public key in the [x509.Certificate] matches
// the public key of the [crypto.Signer].
func verifyKeysMatch(crt *x509.Certificate, signer crypto.Signer) error {
	switch pub := crt.PublicKey.(type) {
	case *rsa.PublicKey:
		pk, ok := signer.Public().(*rsa.PublicKey)
		if !ok {
			return fmt.Errorf("private key type %T does not match issuer public key type %T", signer.Public(), pub)
		}
		if !pub.Equal(pk) {
			return errors.New("private key does not match issuer public key")
		}
	case *ecdsa.PublicKey:
		pk, ok := signer.Public().(*ecdsa.PublicKey)
		if !ok {
			return fmt.Errorf("private key type %T does not match issuer public key type %T", signer.Public(), pub)
		}
		if !pub.Equal(pk) {
			return errors.New("private key does not match issuer public key")
		}
	case ed25519.PublicKey:
		pk, ok := signer.Public().(ed25519.PublicKey)
		if !ok {
			return fmt.Errorf("private key type %T does not match issuer public key type %T", signer.Public(), pub)
		}
		if !pub.Equal(pk) {

View on GitHub (pinned to 50e54ee279)

Solutions

Use a private key whose algorithm matches the issuer's public key algorithm (e.g. both ECDSA or both RSA).

When it happens

Trigger: Thrown at modules/caddypki/crypto.go:132 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/9544ecbc40be5c5b. Report an issue: GitHub.