{"id":"ab73dd9c2f579532","repo":"go-sql-driver/mysql","slug":"invalid-value-unknown-server-pub-key-name-cfg","errorCode":null,"errorMessage":"invalid value / unknown server pub key name: {cfg.ServerPubKey}","messagePattern":"invalid value / unknown server pub key name: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dsn.go","lineNumber":225,"sourceCode":"\t\tdefault:\n\t\t\tcfg.TLS = getTLSConfigClone(cfg.TLSConfig)\n\t\t\tif cfg.TLS == nil {\n\t\t\t\treturn errors.New(\"invalid value / unknown config name: \" + cfg.TLSConfig)\n\t\t\t}\n\t\t}\n\t}\n\n\tif cfg.TLS != nil && cfg.TLS.ServerName == \"\" && !cfg.TLS.InsecureSkipVerify {\n\t\thost, _, err := net.SplitHostPort(cfg.Addr)\n\t\tif err == nil {\n\t\t\tcfg.TLS.ServerName = host\n\t\t}\n\t}\n\n\tif cfg.ServerPubKey != \"\" {\n\t\tcfg.pubKey = getServerPubKey(cfg.ServerPubKey)\n\t\tif cfg.pubKey == nil {\n\t\t\treturn errors.New(\"invalid value / unknown server pub key name: \" + cfg.ServerPubKey)\n\t\t}\n\t}\n\n\tif cfg.Logger == nil {\n\t\tcfg.Logger = defaultLogger\n\t}\n\n\treturn nil\n}\n\nfunc writeDSNParam(buf *bytes.Buffer, hasParam *bool, name, value string) {\n\tbuf.Grow(1 + len(name) + 1 + len(value))\n\tif !*hasParam {\n\t\t*hasParam = true\n\t\tbuf.WriteByte('?')\n\t} else {\n\t\tbuf.WriteByte('&')\n\t}","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/c426bd93799de0f0e094c8f0582872c529d0ed0a/dsn.go#L207-L243","documentation":"When cfg.ServerPubKey is non-empty, normalize() looks it up via getServerPubKey in the registry populated by RegisterServerPubKey. If no key was registered under that name it returns 'invalid value / unknown server pub key name' at dsn.go:225. This registry is used to cache an RSA public key for caching_sha2_password authentication.","triggerScenarios":"A DSN with '?serverPubKey=mykey' without a prior mysql.RegisterServerPubKey('mykey', rsaPubKey); or a misspelled key name; or the key was deregistered.","commonSituations":"Pin-the-server-key setups where registration runs in a different init order; key deregistered between connections; typo between RegisterServerPubKey and the DSN; registration done in a forked/child process.","solutions":["Call mysql.RegisterServerPubKey('mykey', rsaPubKey) before opening the connection.","Check the key spelling matches exactly between RegisterServerPubKey and the DSN.","Drop serverPubKey from the DSN if you do not need to pin the key; the driver will fetch it from the server when needed."],"exampleFix":"// before\ndb, _ := sql.Open(\"mysql\", \"user@tcp(host:3306)/db?serverPubKey=mykey\")\n// after\nmysql.RegisterServerPubKey(\"mykey\", rsaPubKey)\ndb, _ := sql.Open(\"mysql\", \"user@tcp(host:3306)/db?serverPubKey=mykey\")","handlingStrategy":"validation","validationCode":"// Keep an app-level set of the server-pubkey names you have registered.\nvar registeredPubKeys = map[string]bool{}\n// after each RegisterServerPubKey(name, key): registeredPubKeys[name] = true\nfunc pubKeyKnown(name string) bool { return registeredPubKeys[name] }","typeGuard":null,"tryCatchPattern":"if _, err := mysql.ParseDSN(dsn); err != nil && strings.Contains(err.Error(), \"unknown server pub key name\") {\n    // register the key, or remove serverPubKey from the DSN\n}","preventionTips":["Register server public keys in a single init() before opening connections.","Track registered names in an app-level set you can validate against.","Drop serverPubKey unless you specifically need to pin the server key."],"tags":["go","mysql","auth","rsa","dsn","config"],"analyzedSha":"c426bd93799de0f0e094c8f0582872c529d0ed0a","analyzedAt":"2026-08-04T21:52:59.219Z","schemaVersion":2}