ipfs/kubo · error

unexpected PEM block for format=%s: try again with format=%s

Error message

unexpected PEM block for format=%s: try again with format=%s

What it means

`ipfs key import` was run with the default format `libp2p-protobuf-cleartext`, but the input data decoded as a PEM block, which that binary protobuf format never is. Kubo detects the mismatch and tells you to retry with `--format=pem-pkcs8-cleartext`.

Source

Thrown at core/commands/keystore.go:519

			}

			// In case ed25519.PrivateKey is returned we need the pointer for
			// conversion to libp2p (see export command for more details).
			if ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {
				stdKey = &ed25519KeyPointer
			}

			sk, _, err = crypto.KeyPairFromStdKey(stdKey)
			if err != nil {
				return fmt.Errorf("converting std Go key to libp2p key: %w", err)
			}
		case keyFormatLibp2pCleartextOption:
			sk, err = crypto.UnmarshalPrivateKey(data)
			if err != nil {
				// check if data is PEM, if so, provide user with hint
				pemBlock, _ := pem.Decode(data)
				if pemBlock != nil {
					return fmt.Errorf("unexpected PEM block for format=%s: try again with format=%s", keyFormatLibp2pCleartextOption, keyFormatPemCleartextOption)
				}
				return fmt.Errorf("unable to unmarshall format=%s: %w", keyFormatLibp2pCleartextOption, err)
			}

		default:
			return fmt.Errorf("unrecognized import format: %s", importFormat)
		}

		// We only allow importing keys of the same type we generate (see list in
		// https://github.com/ipfs/interface-go-ipfs-core/blob/1c3d8fc/options/key.go#L58-L60),
		// unless explicitly stated by the user.
		allowAnyKeyType, _ := req.Options[keyAllowAnyTypeOptionName].(bool)
		if !allowAnyKeyType {
			switch t := sk.(type) {
			case *crypto.RsaPrivateKey, *crypto.Ed25519PrivateKey, *crypto.Secp256k1PrivateKey:
			default:
				return fmt.Errorf("key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1;"+
					" use flag --%s if you are sure of what you're doing",

View on GitHub (pinned to 329838acdf)

Solutions

1. Re-run with the PEM format flag: `ipfs key import name -f pem-pkcs8-cleartext key.pem`
2. If the key truly is libp2p protobuf format, strip any accidental PEM wrapper from the file

Example fix

// before
$ ipfs key import mykey key.pem  # default format is libp2p-protobuf-cleartext
Error: unexpected PEM block for format=libp2p-protobuf-cleartext: try again with format=pem-pkcs8-cleartext
// after
$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem

data, _ := os.ReadFile(keyFile)
if _, err := pem.Decode(data); err != nil {
    format = "libp2p-protobuf-cleartext"
} else {
    format = "pem-pkcs8-cleartext"
}
// pass --format=<format> to ipfs key import

func looksLikePem(data []byte) bool {
    b, _ := pem.Decode(data)
    return b != nil
}

When it happens

Trigger: `ipfs key import name key.pem` (without `-f`) on a PEM/PKCS8 file, e.g. one produced by `ipfs key export -f pem-pkcs8-cleartext` or openssl.

Common situations: Following the openssl-to-ipfs workflow from the docs but forgetting the `-f pem-pkcs8-cleartext` flag; scripts importing keys exported in PEM format from another node.

Related errors

• expected PRIVATE KEY type in PEM block but got: %s
• encoding PEM block: %w
• PEM block not found in input data: %s
• parsing PKCS8 format: %w
• converting std Go key to libp2p key: %w

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/19a424e1f425cb26. Report an issue: GitHub.