router-for-me/CLIProxyAPI · error

private_key invalid rsa: %w

Error message

private_key invalid rsa: %w

What it means

From ensureRSAPrivateKey when the PEM block is typed 'RSA PRIVATE KEY' (PKCS#1) but x509.ParsePKCS1PrivateKey rejects its DER bytes (keyutil.go:90-93). The PEM wrapper is well-formed, yet the underlying ASN.1 payload is not a valid PKCS#1 RSA private key.

Source

Thrown at internal/auth/vertex/keyutil.go:93

	if block == nil {
		return "", fmt.Errorf("private_key pem decode failed")
	}

	rsaBlock, err := ensureRSAPrivateKey(block)
	if err != nil {
		return "", err
	}
	return string(pem.EncodeToMemory(rsaBlock)), nil
}

func ensureRSAPrivateKey(block *pem.Block) (*pem.Block, error) {
	if block == nil {
		return nil, fmt.Errorf("pem block is nil")
	}

	if block.Type == "RSA PRIVATE KEY" {
		if _, err := x509.ParsePKCS1PrivateKey(block.Bytes); err != nil {
			return nil, fmt.Errorf("private_key invalid rsa: %w", err)
		}
		return block, nil
	}

	if block.Type == "PRIVATE KEY" {
		key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("private_key invalid pkcs8: %w", err)
		}
		rsaKey, ok := key.(*rsa.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("private_key is not an RSA key")
		}
		der := x509.MarshalPKCS1PrivateKey(rsaKey)
		return &pem.Block{Type: "RSA PRIVATE KEY", Bytes: der}, nil
	}

	// Attempt auto-detection: try PKCS#1 first, then PKCS#8.

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Identify the true key format: openssl pkey -in key.pem -noout && openssl rsa -in key.pem -noout -check
2. If it is actually PKCS#8, relabel the header to '-----BEGIN PRIVATE KEY-----' (or re-export from GCP, which always yields a parseable file)
3. Regenerate the service account key in GCP as the guaranteed-clean fix

Example fix

# before (PKCS#8 bytes under an RSA PKCS#1 label)
-----BEGIN RSA PRIVATE KEY-----
MIIEvQ...pkcs8-bytes...
-----END RSA PRIVATE KEY-----
# after
-----BEGIN PRIVATE KEY-----
MIIEvQ...pkcs8-bytes...
-----END PRIVATE KEY-----

block, _ := pem.Decode([]byte(pk))
if block != nil && block.Type == "RSA PRIVATE KEY" {
    if _, err := x509.ParsePKCS1PrivateKey(block.Bytes); err != nil {
        return fmt.Errorf("PKCS#1-labeled key fails to parse; likely mislabeled PKCS#8")
    }
}

When it happens

Trigger: A PKCS#8 or EC key mislabeled with the 'RSA PRIVATE KEY' PEM type; DER bytes corrupted or truncated; a key produced by an exotic tool emitting non-standard PKCS#1 encoding.

Common situations: Users manually retagging PEM headers to 'fix' parser complaints; secrets-manager round trips that corrupt bytes; converting EC keys while keeping the RSA label.

Related errors

• private_key is not an RSA key
• private_key invalid pkcs8: %w
• failed to generate code verifier: %w
• failed to generate random bytes: %w
• failed to generate code verifier: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/03418a2500cbc05f. Report an issue: GitHub.