coredns/coredns · error

no private key found

Error message

no private key found

What it means

After reading and parsing the DNSKEY public record and its private key material, ParseKeyFile returns 'no private key found' when the parsed private key is not one of the supported types (RSA, ECDSA, or Ed25519). The algorithm's private half could not be converted to a signer.

Source

Thrown at plugin/dnssec/dnskey.go:74

	dk, ok := k.(*dns.DNSKEY)
	if !ok {
		return nil, errors.New("no public key found")
	}
	p, e := dk.ReadPrivateKey(f, privFile)
	if e != nil {
		return nil, e
	}

	if s, ok := p.(*rsa.PrivateKey); ok {
		return &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil
	}
	if s, ok := p.(*ecdsa.PrivateKey); ok {
		return &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil
	}
	if s, ok := p.(ed25519.PrivateKey); ok {
		return &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil
	}
	return nil, errors.New("no private key found")
}

// ParseKeyFromAWSSecretsManager retrieves and parses a DNSSEC key pair from AWS Secrets Manager.
func ParseKeyFromAWSSecretsManager(secretID string) (*DNSKEY, error) {
	// Load the AWS SDK configuration
	cfg, err := config.LoadDefaultConfig(context.TODO())
	if err != nil {
		return nil, err
	}

	// Create a Secrets Manager client
	client := secretsmanager.NewFromConfig(cfg)

	// Retrieve the secret value
	input := &secretsmanager.GetSecretValueInput{
		SecretId: &secretID,
	}
	result, err := client.GetSecretValue(context.TODO(), input)

View on GitHub (pinned to 558c9757a9)

Solutions

1. Generate keys with a supported algorithm (e.g. RSASHA256/ECDSAP256SHA256/Ed25519) using `dnssec-keygen -a ECDSAP256SHA256`
2. Ensure the matching `.private` file sits next to the `.key` file and is not corrupted
3. Upgrade CoreDNS/miekg/dns to a version supporting your key algorithm

Example fix

// before
dnssec-keygen -a ED448 example.org
// after
dnssec-keygen -a ECDSAP256SHA256 example.org

// Only use algorithms with supported private key types
supported := map[string]bool{"RSASHA256": true, "ECDSAP256SHA256": true, "ECDSAP384SHA384": true, "ED25519": true}
if !supported[algo] {
    return fmt.Errorf("algorithm %s not supported for dnssec signing", algo)
}

When it happens

Trigger: `ParseKeyFile` reads a key pair whose BIND private-key file parses into a Go type outside the supported set (unsupported algorithm, e.g. certain Ed448/DSA keys), so none of the type assertions on the parsed private key match.

Common situations: Using dnssec-keygen algorithms not supported by miekg/dns or this plugin version; a `.private` file of unexpected format; plugin/binary built without the needed crypto support.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• no public key found
• NSEC3 zone is not supported, dropping RR: %s for zone: %s
• reload duration value is expected
• invalid duration
• at least one address or interface name is expected

AI-assisted analysis of coredns/coredns@558c9757a9 (2026-09-06). Data as JSON: /api/errors/2cc8917138b15c28. Report an issue: GitHub.