hashicorp/terraform · error

failed to create signer from raw private key

Error message

failed to create signer from raw private key %q: %s

What it means

After parsing both the private key and certificate, ssh.NewSignerFromKey is called to create a signer from the raw private key. This fails if the key type does not support signing through this API path, or if the parsed key object is of an unexpected underlying type. SECURITY NOTE: the error interpolates the rawPk object via %q, which may dump key internals into logs.

Solutions

1. Regenerate the key using a well-supported algorithm (RSA 2048/4096 or ECDSA).
2. Update golang.org/x/crypto to the latest version to support newer key types.
3. Verify the private_key value is a plain private key, not a key+certificate bundle.
4. If using ed25519, ensure both the Go toolchain and x/crypto are recent enough for ed25519 signer support.

Example fix

# before — exotic or unsupported key algorithm
connection {
  private_key = var.exotic_key
}

# after — use standard RSA or ECDSA key
ssh-keygen -t rsa -b 4096 -f ~/.ssh/tf_id_rsa
connection {
  private_key = file("~/.ssh/tf_id_rsa")
}

// Test signer creation from the parsed key before full setup
func canCreateSigner(pk string) error {
    rawPk, err := ssh.ParseRawPrivateKey([]byte(pk))
    if err != nil {
        return err
    }
    _, err = ssh.NewSignerFromKey(rawPk)
    return err
}

signer, err := ssh.NewSignerFromKey(rawPk)
if err != nil {
    return nil, fmt.Errorf("cannot create signer from key (unsupported type?): %w", err)
}

When it happens

Trigger: The parsed private key is of a type that ssh.NewSignerFromKey cannot handle (e.g., a multi-key or a key subtype not covered by the switch in x/crypto/ssh). Also triggered if ParseRawPrivateKey returned a valid but unsupported key algorithm for signer construction.

Common situations: Using an exotic or very new key algorithm that the linked golang.org/x/crypto version doesn't support for signing. Using a key that parsed but is a certificate key being passed where a plain key is expected. Version mismatch between the key generation tool and the x/crypto library.

Related errors

• failed to parse private key
• Failed to parse ssh private key
• failed to create cert signer
• failed to parse certificate
• Failed to read ssh private key: no key found

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/213503b22cfbe5e7. Report an issue: GitHub.

Appendix: source

Thrown at internal/communicator/ssh/provisioner.go:410

	return conf, nil
}

// Create a Cert Signer and return ssh.AuthMethod
func signCertWithPrivateKey(pk string, certificate string) (ssh.AuthMethod, error) {
	rawPk, err := ssh.ParseRawPrivateKey([]byte(pk))
	if err != nil {
		return nil, fmt.Errorf("failed to parse private key %q: %s", pk, err)
	}

	pcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certificate))
	if err != nil {
		return nil, fmt.Errorf("failed to parse certificate %q: %s", certificate, err)
	}

	usigner, err := ssh.NewSignerFromKey(rawPk)
	if err != nil {
		return nil, fmt.Errorf("failed to create signer from raw private key %q: %s", rawPk, err)
	}

	ucertSigner, err := ssh.NewCertSigner(pcert.(*ssh.Certificate), usigner)
	if err != nil {
		return nil, fmt.Errorf("failed to create cert signer %q: %s", usigner, err)
	}

	return ssh.PublicKeys(ucertSigner), nil
}

func readPrivateKey(pk string) (ssh.AuthMethod, error) {
	// We parse the private key on our own first so that we can
	// show a nicer error if the private key has a password.
	block, _ := pem.Decode([]byte(pk))
	if block == nil {
		return nil, errors.New("Failed to read ssh private key: no key found")
	}
	if block.Headers["Proc-Type"] == "4,ENCRYPTED" {

View on GitHub (pinned to d32a084675)