rancher/rancher · error

SAML: error parsing PKCS1 RSA key: %v

Error message

SAML: error parsing PKCS1 RSA key: %v

What it means

The PEM block type is RSA PRIVATE KEY (PKCS#1) but x509.ParsePKCS1PrivateKey rejected its bytes, so the body is not a valid PKCS#1 RSA structure. The framing was right; the payload is truncated, corrupted, or actually a different encoding mislabeled with an RSA header.

Source

Thrown at pkg/auth/providers/saml/saml_client.go:118

	}

	if configToSet.SpKey != "" {
		// used from ssh.ParseRawPrivateKey

		block, _ := pem.Decode([]byte(configToSet.SpKey))
		if block == nil {
			return fmt.Errorf("SAML: no key found")
		}

		if strings.Contains(block.Headers["Proc-Type"], "ENCRYPTED") {
			return fmt.Errorf("SAML: cannot decode encrypted private keys")
		}

		switch block.Type {
		case "RSA PRIVATE KEY":
			privKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
			if err != nil {
				return fmt.Errorf("SAML: error parsing PKCS1 RSA key: %v", err)
			}
		case "PRIVATE KEY":
			pk, err := x509.ParsePKCS8PrivateKey(block.Bytes)
			if err != nil {
				return fmt.Errorf("SAML: error parsing PKCS8 RSA key: %v", err)
			}
			privKey, ok = pk.(*rsa.PrivateKey)
			if !ok {
				return fmt.Errorf("SAML: unable to get rsa key")
			}
		default:
			return fmt.Errorf("SAML: unsupported key type %q", block.Type)
		}
	}

	if configToSet.SpCert != "" {
		block, _ := pem.Decode([]byte(configToSet.SpCert))
		if block == nil {

View on GitHub (pinned to 932558d4e6)

Solutions

1. Re-export the key cleanly from the source: openssl rsa -in key.pem -check -out checked.pem to validate, then use checked.pem.
2. If the material is actually PKCS#8, keep its own header (-----BEGIN PRIVATE KEY-----) instead of an RSA PRIVATE KEY header.
3. Diff the stored secret against the original file byte-for-byte (compare fingerprints: openssl pkey -in key.pem -pubout | sha256sum).

Example fix

# before: PKCS#8 body with a PKCS#1 header (parse fails)
-----BEGIN RSA PRIVATE KEY-----
MIIB...PKCS8DATA...
-----END RSA PRIVATE KEY-----

# after: correct header for the body
-----BEGIN PRIVATE KEY-----
MIIB...PKCS8DATA...
-----END PRIVATE KEY-----

block, _ := pem.Decode([]byte(spKey))
if block != nil && block.Type == "RSA PRIVATE KEY" {
    if _, err := x509.ParsePKCS1PrivateKey(block.Bytes); err != nil {
        return fmt.Errorf("spKey fails PKCS#1 parse (%v); key body corrupted or wrong format", err)
    }
}

if err := samlClient.InitializeSamlServiceProvider(cfg, name); err != nil {
    if strings.Contains(err.Error(), "error parsing PKCS1") {
        return fmt.Errorf("spKey PEM header does not match its body; re-export the key and retry")
    }
    return err
}

When it happens

Trigger: Pasting a PKCS#1 header over PKCS#8/EC body, truncating the base64 body on copy, or a YAML/template step that dropped characters or mangled padding.

Common situations: Hand-edited PEM files; clipboard truncation of long keys; scripts that concatenate header + wrong payload; line-length rewrapping that deletes characters.

Related errors

• SAML: no key found
• SAML: cannot decode encrypted private keys
• SAML: error parsing PKCS8 RSA key: %v
• SAML: Cannot initialize saml SP properly, missing SpKey in t
• SAML: unsupported key type %q

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/724b83caf733a07f. Report an issue: GitHub.