What causes "Failed to read key block" in dgraph-io/dgraph?

Verify the file starts with -----BEGIN ... PRIVATE KEY----- (`head -1 `); fix the path if not.

Failed to read key block

Error message

Failed to read key block

What it means

readKey (dgraph/cmd/cert/create.go:105) fails when pem.Decode returns no block, i.e. the key file's bytes are not valid PEM at all (no BEGIN/END block). The tool cannot decode a private key from the file and aborts. This is a defensive error distinguishing 'not PEM' from 'wrong PEM type' (Unknown PEM type).

Source

Thrown at dgraph/cmd/cert/create.go:105

			Type:  "RSA PRIVATE KEY",
			Bytes: x509.MarshalPKCS1PrivateKey(k),
		})
	}
	return nil, errors.Errorf("Unsupported key type: %T", key)
}

// readKey tries to read and decode the contents of a private key file.
// Returns the private key, or error otherwise.
func readKey(keyFile string) (crypto.PrivateKey, error) {
	b, err := os.ReadFile(keyFile)
	if err != nil {
		return nil, err
	}

	block, _ := pem.Decode(b)
	switch {
	case block == nil:
		return nil, errors.Errorf("Failed to read key block")
	case block.Type == "EC PRIVATE KEY":
		return x509.ParseECPrivateKey(block.Bytes)
	case block.Type == "RSA PRIVATE KEY":
		return x509.ParsePKCS1PrivateKey(block.Bytes)
	}
	return nil, errors.Errorf("Unknown PEM type: %s", block.Type)
}

// readCert tries to read and decode the contents of a signed cert file.
// Returns the x509v3 cert, or error otherwise.
func readCert(certFile string) (*x509.Certificate, error) {
	b, err := os.ReadFile(certFile)
	if err != nil {
		return nil, err
	}

	block, _ := pem.Decode(b)
	switch {

View on GitHub (pinned to 759e242be6)

Solutions

Verify the file starts with -----BEGIN ... PRIVATE KEY----- (`head -1 <keyfile>`); fix the path if not.
Regenerate the key pair with `dgraph cert --node --force` or `--client --force` if the file is corrupted or empty.
Convert a DER key to PEM: `openssl rsa -inform DER -in key.der -out key.pem`.
Check file permissions/size — a zero-byte file means a prior creation failed.

Example fix

// before (wrong file, this is a cert)
keyFile := "ca.crt"          // contains -----BEGIN CERTIFICATE-----
// after (correct key file)
keyFile := "ca.key"          // contains -----BEGIN RSA/EC PRIVATE KEY-----

Defensive patterns

Strategy: validation

Validate before calling

b, err := os.ReadFile(keyFile)
if err != nil { return err }
if len(bytes.TrimSpace(b)) == 0 {
    return fmt.Errorf("key file %s is empty", keyFile)
}
if !bytes.Contains(b, []byte("-----BEGIN")) {
    return fmt.Errorf("key file %s is not PEM encoded", keyFile)
}

Type guard

func isPEMKey(data []byte) bool {
    block, _ := pem.Decode(data)
    return block != nil && strings.HasSuffix(block.Type, "PRIVATE KEY")
}

Try / catch

key, err := readKey(keyFile)
if err != nil {
    if err.Error() == "Failed to read key block" {
        return fmt.Errorf("%s is not a PEM file; check path and regenerate keys", keyFile)
    }
    return err
}

Prevention

Confirm the key path points at a .key/.pem file, not a .crt or config file.
Check `head -1` of the key file for a -----BEGIN block before use.
Copy keys with rsync/scp and verify checksums to avoid truncation.
Never hand-edit key files; regenerate with `dgraph cert --force` if damaged.

When it happens

Trigger: Calling readKey (via makeKey/getFileInfo/createNodePair/createClientPair) on a key file that is empty, truncated, DER/binary-encoded instead of PEM, contains only junk text, or whose PEM headers are corrupted.

Common situations: Pointing --key (or tls_key config) at the certificate file or a config file by mistake; key file truncated by a failed transfer; using DER-format keys exported from other tools; empty file created by a previous failed run.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/e0995e7b457dd8ac. Report an issue: GitHub.