ipfs/kubo · error

PEM block not found in input data: %s

Error message

PEM block not found in input data:
%s

What it means

With `ipfs key import --format=pem-pkcs8-cleartext`, the input bytes are parsed with encoding/pem.Decode. If no PEM block is found (no `-----BEGIN ...-----`/`-----END ...-----` envelope), this error is returned and the non-PEM remainder is echoed for diagnosis. The file must be a PEM envelope around a PKCS8 DER private key (e.g. produced by `openssl genpkey`).

Source

Thrown at core/commands/keystore.go:491

		file, err := cmdenv.GetFileArg(req.Files.Entries())
		if err != nil {
			return err
		}
		defer file.Close()

		data, err := io.ReadAll(file)
		if err != nil {
			return err
		}

		importFormat, _ := req.Options[keyFormatOptionName].(string)
		var sk crypto.PrivKey
		switch importFormat {
		case keyFormatPemCleartextOption:
			pemBlock, rest := pem.Decode(data)
			if pemBlock == nil {
				return fmt.Errorf("PEM block not found in input data:\n%s", rest)
			}

			if pemBlock.Type != "PRIVATE KEY" {
				return fmt.Errorf("expected PRIVATE KEY type in PEM block but got: %s", pemBlock.Type)
			}

			stdKey, err := parsePKCS8PrivateKey(pemBlock.Bytes)
			if err != nil {
				return fmt.Errorf("parsing PKCS8 format: %w", err)
			}

			// In case ed25519.PrivateKey is returned we need the pointer for
			// conversion to libp2p (see export command for more details).
			if ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {
				stdKey = &ed25519KeyPointer
			}

			sk, _, err = crypto.KeyPairFromStdKey(stdKey)

View on GitHub (pinned to 329838acdf)

Solutions

1. Check the input actually contains `-----BEGIN PRIVATE KEY-----`; if it is raw DER, re-emit as PEM: `openssl pkey -in key.der -inform DER -out key.pem`
2. Use the right format flag: PEM files need `-f pem-pkcs8-cleartext`; native libp2p files need the default format
3. Verify the file is non-empty and not base64-wrapped: `head -1 <file>`
4. Regenerate the key with `openssl genpkey -algorithm ED25519 > key.pem` if the source file is corrupt

Example fix

// before
openssl genpkey -algorithm ED25519 -outform DER -out k.der
ipfs key import mykey -f pem-pkcs8-cleartext k.der
// after
openssl genpkey -algorithm ED25519 -out k.pem
ipfs key import mykey -f pem-pkcs8-cleartext k.pem

# verify the input is a PEM private-key envelope before import
grep -q -- "-----BEGIN PRIVATE KEY-----" "$file" || { echo "$file is not PEM PKCS8"; exit 1; }
openssl pkey -in "$file" -noout && echo 'valid pkcs8 pem'

// Go-side pre-check equivalent:
block, _ := pem.Decode(data)
if block == nil || block.Type != "PRIVATE KEY" {
    return fmt.Errorf("input is not a PEM PKCS8 PRIVATE KEY")
}

When it happens

Trigger: Importing a raw DER key (openssl `genpkey -outform DER`), a libp2p protobuf key file, or an encrypted PEM (`ENCRYPTED PRIVATE KEY` is still a block, but raw DER is not) while `--format=pem-pkcs8-cleartext` is set; also importing an empty file or a file with only garbage.

Common situations: Forgetting `--format` (defaults to libp2p-protobuf-cleartext) when feeding a PEM file — that fails differently — versus the reverse: passing a DER/protobuf file with the PEM format selected; downloading a key that got base64-mangled; empty file from a failed openssl run.

Related errors

• encoding PEM block: %w
• refusing to export key to %s: not a regular file, character
• cannot import key with name 'self'
• invalid configuration profile: %s
• Import.CidVersion must be 0 or 1, got %d

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/bfd9a63bbe9ce665. Report an issue: GitHub.