jenkinsci/jenkins · error · InvalidKeyException

Unsupported private key file format: key

Error message

Unsupported private key file format: key

What it means

InvalidKeyException thrown by PrivateKeyProvider.loadKey when SecurityUtils.loadKeyPairIdentities (Apache MINA/SSHD) parses zero key pairs from the supplied PEM string. The data was not recognized as any supported private key format (RSA, DSA, ECDSA, EdDSA in PEM/OpenSSH form).

Source

Thrown at cli/src/main/java/hudson/cli/PrivateKeyProvider.java:151

    private static String readPemFile(File f) throws IOException {
        try (InputStream is = Files.newInputStream(f.toPath());
             DataInputStream dis = new DataInputStream(is)) {
            byte[] bytes = new byte[(int) f.length()];
            dis.readFully(bytes);
            return new String(bytes, StandardCharsets.UTF_8);
        } catch (InvalidPathException e) {
            throw new IOException(e);
        }
    }

    public static KeyPair loadKey(String pemString, String passwd) throws IOException, GeneralSecurityException {
        Iterable<KeyPair> itr = SecurityUtils.loadKeyPairIdentities(null,
                new PathResource(Paths.get("key")),
                new ByteArrayInputStream(pemString.getBytes(StandardCharsets.UTF_8)),
                FilePasswordProvider.of(passwd));
        long numLoaded = itr == null ? 0 : StreamSupport.stream(itr.spliterator(), false).count();
        if (numLoaded <= 0) {
            throw new InvalidKeyException("Unsupported private key file format: key");
        }
        if (numLoaded != 1) {
            throw new InvalidKeySpecException("Multiple private key pairs N/A: key");
        }
        return itr.iterator().next();
    }

    private static final Logger LOGGER = Logger.getLogger(PrivateKeyProvider.class.getName());
}

View on GitHub (pinned to 2e228ff40b)

Solutions

1. Confirm the -i file is the private key (begins with '-----BEGIN ... PRIVATE KEY-----').
2. If using a new OpenSSH key format, convert it to PEM with 'ssh-keygen -p -m PEM -f key' or generate a key in a supported format.
3. Ensure the CLI/SSHD library version supports the key type (upgrade Jenkins/CLI if using Ed25519 or ECDSA on an old build).

Example fix

# before: unsupported OpenSSH new format
ssh-keygen -t ed25519 -f key
java -jar jenkins-cli.jar -i key -s http://j ... 
# after: convert to PEM
ssh-keygen -p -m PEM -f key
java -jar jenkins-cli.jar -i key -s http://j ...

// Validate the file looks like a supported private key before passing to -i
String pem = Files.readString(Path.of(keyFile));
boolean looksValid = pem.contains("-----BEGIN") && pem.contains("PRIVATE KEY-----");
if (!looksValid) {
    throw new IllegalArgumentException(keyFile + " is not a recognizable private key");
}

try {
    PrivateKeyProvider.loadKey(pem, passwd);
} catch (InvalidKeyException e) {
    // prompt the user to supply a valid PEM private key or convert the format
}

When it happens

Trigger: Passing -i with a file that is a public key, a certificate, an SSH config, an empty/truncated file, or a key in a format the bundled SSHD version cannot parse (e.g. PKCS#12, or a newer OpenSSH format on an older library).

Common situations: Wrong file passed to -i (pubkey instead of private key); key generated with a very new OpenSSH format not yet supported by the bundled SSHD; file encoding/BOM issues; copy-paste truncation of the PEM block.

Related errors

• Multiple private key pairs N/A: key
• Failed to retrieve command result in time: {}
• Unknown public key type:
• There's no Jenkins running at {}
• expected to see initial zero byte; perhaps you are connectin

AI-assisted analysis of jenkinsci/jenkins@2e228ff40b (2026-08-14). Data as JSON: /api/errors/4831c62a44c015d2. Report an issue: GitHub.