dgraph-io/dgraph · error

Unknown PEM type: %s

Error message

Unknown PEM type: %s

What it means

readKey (dgraph/cmd/cert/create.go:111) fails when the file is valid PEM but its block Type is neither "EC PRIVATE KEY" nor "RSA PRIVATE KEY". The tool only supports those two PEM labels for private keys, so anything else (e.g. "PRIVATE KEY" PKCS#8, "ENCRYPTED PRIVATE KEY", "CERTIFICATE") is rejected.

Source

Thrown at dgraph/cmd/cert/create.go:111

// readKey tries to read and decode the contents of a private key file.
// Returns the private key, or error otherwise.
func readKey(keyFile string) (crypto.PrivateKey, error) {
	b, err := os.ReadFile(keyFile)
	if err != nil {
		return nil, err
	}

	block, _ := pem.Decode(b)
	switch {
	case block == nil:
		return nil, errors.Errorf("Failed to read key block")
	case block.Type == "EC PRIVATE KEY":
		return x509.ParseECPrivateKey(block.Bytes)
	case block.Type == "RSA PRIVATE KEY":
		return x509.ParsePKCS1PrivateKey(block.Bytes)
	}
	return nil, errors.Errorf("Unknown PEM type: %s", block.Type)
}

// readCert tries to read and decode the contents of a signed cert file.
// Returns the x509v3 cert, or error otherwise.
func readCert(certFile string) (*x509.Certificate, error) {
	b, err := os.ReadFile(certFile)
	if err != nil {
		return nil, err
	}

	block, _ := pem.Decode(b)
	switch {
	case block == nil:
		return nil, errors.Errorf("Failed to read cert block")
	case block.Type != "CERTIFICATE":
		return nil, errors.Errorf("Unknown PEM type: %s", block.Type)
	}

View on GitHub (pinned to 759e242be6)

Solutions

1. Check the PEM header (`head -1 <keyfile>`); confirm it says EC PRIVATE KEY or RSA PRIVATE KEY.
2. Convert PKCS#8 to traditional PEM: `openssl rsa -in key.pem -out key.trad.pem` (or `openssl ec` for EC keys).
3. Decrypt encrypted keys first: `openssl rsa -in encrypted.pem -out unencrypted.pem` and remove the passphrase.
4. If the path points at a certificate, fix the path to the .key file.

Example fix

// before: PKCS#8 key not accepted
// file starts with: -----BEGIN PRIVATE KEY-----
// after: convert to traditional PEM first
// $ openssl rsa -in key.pem -out key.trad.pem  → -----BEGIN RSA PRIVATE KEY-----

b, _ := os.ReadFile(keyFile)
block, _ := pem.Decode(b)
if block != nil && block.Type != "EC PRIVATE KEY" && block.Type != "RSA PRIVATE KEY" {
    return fmt.Errorf("key %s has PEM type %q; convert to traditional RSA/EC PEM first", keyFile, block.Type)
}

func isSupportedPEMKeyType(data []byte) bool {
    block, _ := pem.Decode(data)
    return block != nil &&
        (block.Type == "EC PRIVATE KEY" || block.Type == "RSA PRIVATE KEY")
}

key, err := readKey(keyFile)
if err != nil {
    if strings.HasPrefix(err.Error(), "Unknown PEM type") {
        return fmt.Errorf("convert the key to traditional PEM (openssl rsa / openssl ec): %w", err)
    }
    return err
}

When it happens

Trigger: readKey is given a key file whose PEM header doesn't match: a PKCS#8 key (BEGIN PRIVATE KEY), an encrypted key (BEGIN ENCRYPTED PRIVATE KEY), or accidentally a certificate file (BEGIN CERTIFICATE).

Common situations: Importing keys generated by openssl/newer tooling that defaults to PKCS#8 format; pointing the key path at a cert; using password-protected keys; keys converted by other tools with different PEM labels.

Related errors

• Failed to read key block
• %s: verification failed
• Key size value is too large (x > 4096)
• Key size value must be a factor of 2
• Elliptic curve value must be one of: P224, P256, P384 or P52

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/8d63ad81d24ce608. Report an issue: GitHub.