slackhq/nebula · error

ErrInvalidPEMEd25519PrivateKeyBanner

ErrInvalidPEMEd25519PrivateKeyBanner

Error message

bytes did not contain a proper Ed25519 private key banner

What it means

ErrInvalidPEMEd25519PrivateKeyBanner is thrown when PEM bytes expected to contain an Ed25519 private key lack the proper Ed25519 PRIVATE KEY banner. The library validates the PEM block type before decoding, so any other key type or a malformed block is rejected.

Source

Thrown at cert/errors.go:32

	ErrBlockListed                = errors.New("certificate is in the block list")
	ErrFingerprintMismatch        = errors.New("certificate fingerprint did not match")
	ErrSignatureMismatch          = errors.New("certificate signature did not match")
	ErrInvalidPublicKey           = errors.New("invalid public key")
	ErrInvalidPrivateKey          = errors.New("invalid private key")
	ErrPublicPrivateCurveMismatch = errors.New("public key does not match private key curve")
	ErrPublicPrivateKeyMismatch   = errors.New("public key and private key are not a pair")
	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
	ErrUnknownVersion             = errors.New("certificate version unrecognized")
	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
	ErrCurveMismatch              = errors.New("certificate curve does not match CA")

	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")
	ErrInvalidPEMX25519PublicKeyBanner   = errors.New("bytes did not contain a proper X25519 public key banner")
	ErrInvalidPEMX25519PrivateKeyBanner  = errors.New("bytes did not contain a proper X25519 private key banner")
	ErrInvalidPEMEd25519PublicKeyBanner  = errors.New("bytes did not contain a proper Ed25519 public key banner")
	ErrInvalidPEMEd25519PrivateKeyBanner = errors.New("bytes did not contain a proper Ed25519 private key banner")

	ErrNoPeerStaticKey = errors.New("no peer static key was present")
	ErrNoPayload       = errors.New("provided payload was empty")

	ErrMissingDetails  = errors.New("certificate did not contain details")
	ErrEmptySignature  = errors.New("empty signature")
	ErrEmptyRawDetails = errors.New("empty rawDetails not allowed")
)

type ErrInvalidCertificateProperties struct {
	str string
}

func NewErrInvalidCertificateProperties(format string, a ...any) error {
	return &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}
}

func (e *ErrInvalidCertificateProperties) Error() string {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check that the key file starts with the proper Ed25519 private key BEGIN banner
2. Fix the secret/path so the Ed25519 private key (not a public key or other curve's key) is loaded
3. Re-generate or re-export the signing key as Ed25519 if the algorithm changed

Example fix

// before
keyBytes, _ := os.ReadFile("x25519.key")
// after
keyBytes, _ := os.ReadFile("ed25519.key") // proper Ed25519 PRIVATE KEY banner

block, _ := pem.Decode(keyBytes)
if block == nil || !strings.Contains(block.Type, "ED25519 PRIVATE KEY") {
    return fmt.Errorf("not an Ed25519 private key PEM")
}

func isEd25519PrivateKeyPEM(b []byte) bool {
    blk, _ := pem.Decode(b)
    return blk != nil && strings.Contains(blk.Type, "ED25519 PRIVATE KEY")
}

key, err := loadEd25519PrivKey(keyBytes)
if errors.Is(err, cert.ErrInvalidPEMEd25519PrivateKeyBanner) {
    // wrong key type mounted: fix secret/source
}

When it happens

Trigger: Passing bytes with a wrong or missing PEM banner to an Ed25519 private key parser — e.g. an X25519 private key, a public key, or a non-PEM blob.

Common situations: Secret mounted from the wrong file in Kubernetes/container environments; key regenerated as X25519 after a curve migration; newline/base64 corruption during copy-paste into env vars.

Related errors

• ErrInvalidPEMEd25519PublicKeyBanner
• ErrInvalidPEMX25519PrivateKeyBanner
• key was not %d bytes, is invalid Ed25519 private key
• ErrTruncatedPEMBlock
• Empty configuration

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/67bebb3aeddf795f. Report an issue: GitHub.