nautechsystems/nautilus_trader · error · anyhow::Error

No valid private key found in {}

Error message

No valid private key found in {}

What it means

load_private_key opens the PEM file at path and tries to parse a SEC1/EC private key block; if the file yields no valid private key it bails. The message includes the path so the offending key file can be located quickly.

Source

Thrown at crates/network/src/tls.rs:205

}

fn load_private_key(path: &Path) -> anyhow::Result<PrivateKeyDer<'static>> {
    let file = File::open(path)?;
    if let Some(key) = PrivatePkcs8KeyDer::pem_reader_iter(file).find_map(Result::ok) {
        return Ok(key.into());
    }

    let file = File::open(path)?;
    if let Some(key) = PrivatePkcs1KeyDer::pem_reader_iter(file).find_map(Result::ok) {
        return Ok(key.into());
    }

    let file = File::open(path)?;
    if let Some(key) = PrivateSec1KeyDer::pem_reader_iter(file).find_map(Result::ok) {
        return Ok(key.into());
    }

    anyhow::bail!("No valid private key found in {}", path.display());
}

fn load_certs(path: &Path) -> anyhow::Result<Vec<CertificateDer<'static>>> {
    let file = File::open(path)?;
    let certs = CertificateDer::pem_reader_iter(file)
        .filter_map(std::result::Result::ok)
        .collect();
    Ok(certs)
}

#[cfg(test)]
mod tests {
    use std::{io::Cursor, sync::Arc};

    use rstest::rstest;
    use rustls::{
        ClientConnection, Connection, ServerConnection,
        pki_types::{PrivatePkcs1KeyDer, PrivatePkcs8KeyDer, PrivateSec1KeyDer, ServerName},

View on GitHub (pinned to 18893faf8b)

Solutions

1. Verify the file actually contains a private key PEM block (-----BEGIN PRIVATE KEY----- / -----BEGIN EC PRIVATE KEY-----).
2. Regenerate the key in a supported, unencrypted format (openssl ecparam / openssl genpkey without encryption).
3. Check you passed the key path, not the cert path, to the loader.
4. Inspect the file for truncation/corruption (openssl pkey -in file -check).

Example fix

// before
let key = load_private_key(Path::new("/etc/certs/ca.pem"))?; // wrong file
// after
let key = load_private_key(Path::new("/etc/certs/client.key"))?;

// Rust: pre-validate the key file contains a PEM block
let text = std::fs::read_to_string(path)?;
if !text.contains("PRIVATE KEY") {
    return Err(anyhow::anyhow!("no private key block in {}", path.display()));
}

fn pem_file_contains_key(path: &std::path::Path) -> bool {
    std::fs::read_to_string(path).map(|t| t.contains("PRIVATE KEY")).unwrap_or(false)
}

let key = load_private_key(path)
    .map_err(|e| { log::error!("key load failed: {e}"); e })?;

When it happens

Trigger: create_tls_config_from_certs_dir (or tests) calling load_private_key on a file that is empty, contains only certificates, has a malformed/truncated PEM block, or a key format the parser does not support (e.g. encrypted PKCS#8 with unsupported settings).

Common situations: Passing the certificate file where the key file is expected; key file truncated during copy/secret mount; concatenated multi-key files with the first block malformed; keys generated in an unsupported encoding.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Certificate path is not a directory: {}
• {private_key_env} not found in config or environment
• Failed to parse PEM: {e}
• PEM does not contain a private key
• Client certificate or private key missing in {} but client a

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/cd28b9cf42c06627. Report an issue: GitHub.