denoland/deno · error · TypeError

If "keyFormat" is specified, it must be "pem": received "${k

Error message

If "keyFormat" is specified, it must be "pem": received "${keyFormat}"

What it means

connectTls/listenTls accept an optional keyFormat option, but loadTlsKeyPair() implements only 'pem': any defined value other than 'pem' throws this TypeError. Leaving keyFormat undefined is fine and implies PEM.

Source

Thrown at ext/net/02_tls.js:142

}

/**
 * Loads a TLS keypair from one of the various options. If no key material is provided,
 * returns a special Null keypair.
 */
function loadTlsKeyPair(api, {
  keyFormat,
  cert,
  key,
}) {
  // TODO(mmastrac): remove this temporary symbol when the API lands
  if (arguments[1][resolverSymbol] !== undefined) {
    return createTlsKeyResolver(arguments[1][resolverSymbol]);
  }

  // Check for "pem" format
  if (keyFormat !== undefined && keyFormat !== "pem") {
    throw new TypeError(
      `If "keyFormat" is specified, it must be "pem": received "${keyFormat}"`,
    );
  }

  if (cert !== undefined && key === undefined) {
    throw new TypeError(
      `If \`cert\` is specified, \`key\` must be specified as well for \`${api}\``,
    );
  }
  if (cert === undefined && key !== undefined) {
    throw new TypeError(
      `If \`key\` is specified, \`cert\` must be specified as well for \`${api}\``,
    );
  }

  if (cert !== undefined) {
    return op_tls_key_static(cert, key);
  } else {

View on GitHub (pinned to 89f33cbef2)

Solutions

Drop the keyFormat option - PEM is the default and only supported format
If your keys are DER, convert them first: openssl pkey -inform DER -outform PEM -in key.der -out key.pem
Pass the PEM file contents as strings for cert and key

Example fix

// before
await Deno.connectTls({ hostname, port, cert: derCert, key: derKey, keyFormat: "der" });

// after
await Deno.connectTls({ hostname, port, cert: pemCert, key: pemKey });

Defensive patterns

Strategy: validation

Validate before calling

function normalizeKeyFormat(fmt: string | undefined): "pem" | undefined {
  if (fmt !== undefined && fmt !== "pem") {
    throw new Error(`Only PEM keys are supported; convert DER first (openssl pkey -inform DER -outform PEM)`);
  }
  return fmt;
}

Type guard

function isPemKeyFormat(f: unknown): boolean {
  return f === undefined || f === "pem";
}

Prevention

Standardize on PEM files for all certs/keys in the project
Do not copy keyFormat examples from other runtimes' APIs
Store the conversion command (openssl pkey) next to your key tooling for DER artifacts

When it happens

Trigger: Deno.connectTls({ ..., cert, key, keyFormat: 'der' }); listenTls with keyFormat: 'pkcs8'; any non-'pem' string.

Common situations: Porting code from libraries whose key APIs accept multiple encodings (Node's DER/PEM distinctions, JWT libraries); hand-rolling cert option objects from examples that include keyFormat.

Related errors

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/476df96f9ba72659. Report an issue: GitHub.