hashicorp/nomad · error

error encoding private key

Error message

error encoding private key: %s

What it means

pemEncodeKey wraps the DER bytes of a private key in a PEM block of the given type (e.g. "EC PRIVATE KEY") using pem.Encode. If PEM encoding to the in-memory buffer fails, the error is wrapped with this message. pem.Encode rarely fails, making this an exceptional defensive path.

Solutions

1. Inspect the wrapped underlying error for the real cause.
2. Retry generation; regenerate the key/cert pair.
3. Report to the maintainers if reproducible, since pem.Encode of valid DER should not fail.

signer, pemKey, err := tlsutil.GeneratePrivateKey()
if err != nil {
    if strings.Contains(err.Error(), "error encoding private key") {
        return fmt.Errorf("pem encode failed: %w", err)
    }
    return err
}

When it happens

Trigger: pem.Encode returns a non-nil error while pemEncodeKey encodes marshaled private-key bytes during GeneratePrivateKey.

Common situations: Practically unreachable with valid DER input; would only surface from anomalies in the bytes.Buffer or pem writer.

Related errors

• Failed to parse any valid certificates in CA file
• failed to parse certificate
• failed to parse root certificate
• first PEM-block should be CERTIFICATE type
• no PEM-encoded data found

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2b0ebd6819e50cb1. Report an issue: GitHub.

Appendix: source

Thrown at helper/tlsutil/generate.go:60

	bs, err := x509.MarshalECPrivateKey(pk)
	if err != nil {
		return nil, "", fmt.Errorf("error marshaling ECDSA private key: %s", err)
	}

	pemBlock, err := pemEncodeKey(bs, "EC PRIVATE KEY")
	if err != nil {
		return nil, "", err
	}

	return pk, pemBlock, nil
}

func pemEncodeKey(key []byte, blockType string) (string, error) {
	var buf bytes.Buffer

	if err := pem.Encode(&buf, &pem.Block{Type: blockType, Bytes: key}); err != nil {
		return "", fmt.Errorf("error encoding private key: %s", err)
	}
	return buf.String(), nil
}

type CAOpts struct {
	Signer              crypto.Signer
	Serial              *big.Int
	Days                int
	PermittedDNSDomains []string
	Country             string
	PostalCode          string
	Province            string
	Locality            string
	StreetAddress       string
	Organization        string
	OrganizationalUnit  string
	Name                string
}

View on GitHub (pinned to 482b49bf1a)