{"id":"bfe936ba3fe49379","repo":"jackc/pgx","slug":"unable-to-decrypt-key-w","errorCode":null,"errorMessage":"unable to decrypt key: %w","messagePattern":"unable to decrypt key: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/config.go","lineNumber":957,"sourceCode":"\t\t\t// Attempt decryption with pass phrase\n\t\t\t// NOTE: only supports RSA (PKCS#1)\n\t\t\tif sslpassword != \"\" {\n\t\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword)) //nolint:ineffassign\n\t\t\t}\n\t\t\t// if sslpassword not provided or has decryption error when use it\n\t\t\t// try to find sslpassword with callback function\n\t\t\tif sslpassword == \"\" || decryptedError != nil {\n\t\t\t\tif parseConfigOptions.GetSSLPassword != nil {\n\t\t\t\t\tsslpassword = parseConfigOptions.GetSSLPassword(context.Background())\n\t\t\t\t}\n\t\t\t\tif sslpassword == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unable to find sslpassword\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword))\n\t\t\t// Should we also provide warning for PKCS#1 needed?\n\t\t\tif decryptedError != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"unable to decrypt key: %w\", decryptedError)\n\t\t\t}\n\n\t\t\tpemBytes := pem.Block{\n\t\t\t\tType:  \"RSA PRIVATE KEY\",\n\t\t\t\tBytes: decryptedKey,\n\t\t\t}\n\t\t\tpemKey = pem.EncodeToMemory(&pemBytes)\n\t\t} else {\n\t\t\tpemKey = pem.EncodeToMemory(block)\n\t\t}\n\t\tcertfile, err := os.ReadFile(sslcert)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to read cert: %w\", err)\n\t\t}\n\t\tcert, err := tls.X509KeyPair(certfile, pemKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load cert: %w\", err)\n\t\t}","sourceCodeStart":939,"sourceCodeEnd":975,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/config.go#L939-L975","documentation":"Error \"unable to decrypt key: %w\" thrown in jackc/pgx.","triggerScenarios":"Thrown at pgconn/config.go:957 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}