karatelabs/karate · error · RuntimeException

failed to load private key: unsupported algorithm

Error message

failed to load private key: unsupported algorithm

What it means

Karate's private-key loader only tries RSA and then EC KeyFactory instances; if the key file is neither an RSA nor an EC private key (e.g. Ed25519, DSA, or a non-PKCS#8 encoding), both attempts fail and this RuntimeException is thrown with the fixed message 'unsupported algorithm'.

Solutions

1. Convert the key to PKCS#8 RSA or EC: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem
2. Regenerate the key with an RSA algorithm (e.g. openssl genrsa 2048) or EC (ecparam -name prime256v1)
3. Avoid Ed25519/DSA keys for TLS config consumed by Karate
4. Check the wrapped cause e2 to distinguish format problems from true algorithm mismatch

Example fix

// before: Ed25519 key fails to load
// ssh-keygen -t ed25519 -m PEM ...
// after: regenerate as RSA and convert to PKCS#8
// openssl genrsa -out server.key 2048
// openssl pkcs8 -topk8 -nocrypt -in server.key -out server.pkcs8.key

// detect key algorithm before loading
static String keyAlgorithm(java.io.File keyFile) throws Exception {
    String pem = java.nio.file.Files.readString(keyFile.toPath());
    if (pem.contains("BEGIN RSA")) return "RSA";
    if (pem.contains("BEGIN EC")) return "EC";
    return "UNKNOWN"; // Ed25519/DSA/etc will fail in Karate
}

static boolean isSupportedKey(File f) throws Exception { String a = keyAlgorithm(f); return a.equals("RSA") || a.equals("EC"); }

try { return SslUtils.privateKey(keyBytes); } catch (RuntimeException e) { if (e.getMessage().contains("unsupported algorithm")) { throw new IllegalStateException("convert key to PKCS#8 RSA/EC"); } throw e; }

When it happens

Trigger: Calling privateKey(...) / loadPrivateKeyFromFile with a key file whose algorithm is not RSA or EC — typically Ed25519 or DSA keys, or keys in a format (PKCS#1, encrypted PEM) that neither KeyFactory can parse.

Common situations: Generating modern SSH/OpenSSL keys that default to Ed25519 and using them in Karate TLS config; using an old DSA certificate; passing a PKCS#1 'BEGIN RSA PRIVATE KEY' file to a JDK expecting PKCS#8.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• failed to create client SSL context
• failed to create server SSL context
• failed to load private key: unsupported algorithm
• failed to generate self-signed certificate
• failed to generate Netty SSL context

AI-assisted analysis of karatelabs/karate@a22eb90246 (2026-09-12). Data as JSON: /api/errors/2a7ee7cce8910b7d. Report an issue: GitHub.

Appendix: source

Thrown at karate-core/src/main/java/io/karatelabs/core/SslUtils.java:149

        // Remove PEM headers/footers and decode
        String privateKeyPEM = keyString
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replace("-----BEGIN RSA PRIVATE KEY-----", "")
                .replace("-----END RSA PRIVATE KEY-----", "")
                .replaceAll("\\s", "");

        byte[] decoded = java.util.Base64.getDecoder().decode(privateKeyPEM);
        java.security.spec.PKCS8EncodedKeySpec keySpec = new java.security.spec.PKCS8EncodedKeySpec(decoded);

        // Try RSA first, then EC
        try {
            return java.security.KeyFactory.getInstance("RSA").generatePrivate(keySpec);
        } catch (Exception e) {
            try {
                return java.security.KeyFactory.getInstance("EC").generatePrivate(keySpec);
            } catch (Exception e2) {
                throw new RuntimeException("failed to load private key: unsupported algorithm", e2);
            }
        }
    }

}

View on GitHub (pinned to a22eb90246)