caddyserver/caddy · error

unsupported format: %s

Error message

unsupported format: %s

What it means

Error "unsupported format: %s" thrown in caddyserver/caddy.

Source

Thrown at modules/caddypki/crypto.go:121

		var key crypto.Signer
		if kp.PrivateKey != "" {
			keyData, err := os.ReadFile(kp.PrivateKey)
			if err != nil {
				return nil, nil, err
			}
			key, err = certmagic.PEMDecodePrivateKey(keyData)
			if err != nil {
				return nil, nil, err
			}
			if err := verifyKeysMatch(chain[0], key); err != nil {
				return nil, nil, err
			}
		}

		return chain, key, nil

	default:
		return nil, nil, fmt.Errorf("unsupported format: %s", kp.Format)
	}
}

// verifyKeysMatch verifies that the public key in the [x509.Certificate] matches
// the public key of the [crypto.Signer].
func verifyKeysMatch(crt *x509.Certificate, signer crypto.Signer) error {
	switch pub := crt.PublicKey.(type) {
	case *rsa.PublicKey:
		pk, ok := signer.Public().(*rsa.PublicKey)
		if !ok {
			return fmt.Errorf("private key type %T does not match issuer public key type %T", signer.Public(), pub)
		}
		if !pub.Equal(pk) {
			return errors.New("private key does not match issuer public key")
		}
	case *ecdsa.PublicKey:
		pk, ok := signer.Public().(*ecdsa.PublicKey)
		if !ok {

View on GitHub (pinned to 50e54ee279)

Solutions

1. Use a supported certificate/key format such as PEM.

When it happens

Trigger: Thrown at modules/caddypki/crypto.go:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/a879381eaf71a89e. Report an issue: GitHub.