karatelabs/karate · error · RuntimeException

failed to load private key: unsupported algorithm

Error message

failed to load private key: unsupported algorithm

What it means

When loading a PEM private key, loadPrivateKey first tries RSA then EC KeyFactory. If both fail, it concludes the key uses an unsupported algorithm and throws "failed to load private key: unsupported algorithm" (wrapping the EC failure).

Solutions

1. Regenerate/convert the key to RSA: `openssl genrsa -out server.key 2048` or `openssl pkey -in key.pem -traditional` conversion as appropriate
2. Check the PEM header — use `-----BEGIN PRIVATE KEY-----` (PKCS#8) or `-----BEGIN RSA PRIVATE KEY-----` unencrypted material
3. If you need EC, ensure the key is a standard curve (prime256v1/secp384r1); otherwise use RSA

Example fix

// before: ssh-keygen -t ed25519 (unsupported)
// after
$ openssl genrsa -out server.key 2048
$ openssl req -new -x509 -key server.key -out server.crt

// detect the key type before loading
String head = java.nio.file.Files.readAllLines(java.nio.file.Path.of(keyPath)).get(0);
// accept only RSA/EC-compatible PKCS material
if (head.contains("ED25519") || head.contains("DSA")) throw new IllegalStateException("unsupported key algorithm, regenerate as RSA");

try { SslContextFactory.loadPrivateKey(pemBytes); } catch (RuntimeException e) { throw new IllegalStateException("convert key to RSA or standard EC curve: openssl genrsa -out key 2048", e); }

When it happens

Trigger: Calling the SSL server/cert setup with a private key PEM that is neither RSA nor EC — e.g. Ed25519 keys, DSA keys, or PKCS#8 content the KeyFactory can't interpret.

Common situations: Modern ssh-keygen/openssl generating Ed25519 keys by default; DSA keys from legacy tooling; a certificate pasted where a key belongs; PEM header mismatch (e.g. encrypted PKCS#8).

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• failed to create server SSL context
• failed to create SSL context from files
• failed to create client SSL context
• failed to generate self-signed certificate
• failed to generate Netty SSL context

AI-assisted analysis of karatelabs/karate@a22eb90246 (2026-09-12). Data as JSON: /api/errors/af861cdcf3b5ee87. Report an issue: GitHub.

Appendix: source

Thrown at karate-core/src/main/java/io/karatelabs/core/SslContextFactory.java:212

        // Remove PEM headers/footers and decode
        String privateKeyPEM = keyString
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replace("-----BEGIN RSA PRIVATE KEY-----", "")
                .replace("-----END RSA PRIVATE KEY-----", "")
                .replaceAll("\\s", "");

        byte[] decoded = Base64.getDecoder().decode(privateKeyPEM);
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(decoded);

        // Try RSA first, then EC
        try {
            return KeyFactory.getInstance("RSA").generatePrivate(keySpec);
        } catch (Exception e) {
            try {
                return KeyFactory.getInstance("EC").generatePrivate(keySpec);
            } catch (Exception e2) {
                throw new RuntimeException("failed to load private key: unsupported algorithm", e2);
            }
        }
    }

    /**
     * Load resource from path (supports classpath: prefix).
     */
    private static byte[] loadResource(String path) {
        Resource resource = Resource.path(path);
        return FileUtils.toBytes(resource.getText());
    }

}

View on GitHub (pinned to a22eb90246)