t8y2/dbx · error
unsupported private key encoding
Error message
unsupported private key encoding
What it means
parsePrivateKey tries PKCS#8, PKCS#1 (RSA), and SEC1 (EC) PEM decodings in order; if none succeed, the key bytes are in an unrecognized encoding and the library returns this error instead of a private key.
Source
Thrown at agents/drivers/hive-go/zookeeper_tls.go:239
certificates = append(certificates, certificate)
}
if len(certificates) == 0 {
return nil, errors.New("PEM truststore contains no certificates")
}
return certificates, nil
}
func parsePrivateKey(contents []byte) (any, error) {
if value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {
return value, nil
}
if value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {
return value, nil
}
if value, err := x509.ParseECPrivateKey(contents); err == nil {
return value, nil
}
return nil, errors.New("unsupported private key encoding")
}
View on GitHub (pinned to c0390bff16)
Solutions
- Check the key file actually contains '-----BEGIN ... PRIVATE KEY-----' and is not the certificate.
- Decrypt/re-encode the key unencrypted to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem.
- If the key is encrypted, remove the passphrase (openssl rsa -in key.pem -out key-nopass.pem) or supply it via the mechanism the driver supports.
Example fix
# before: encrypted or traditional key fails parse -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED // after openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pem -----BEGIN PRIVATE KEY-----
Defensive patterns
Strategy: validation
Validate before calling
func keyIsParseablePEM(path string) error {
b, err := os.ReadFile(path); if err != nil { return err }
block, _ := pem.Decode(b)
if block == nil { return errors.New("not PEM") }
switch block.Type {
case "PRIVATE KEY", "RSA PRIVATE KEY", "EC PRIVATE KEY":
return nil
}
return fmt.Errorf("unsupported PEM block %q (encrypted?)", block.Type)
} Type guard
func isSupportedKeyPEM(block *pem.Block) bool {
return block != nil && (block.Type == "PRIVATE KEY" || block.Type == "RSA PRIVATE KEY" || block.Type == "EC PRIVATE KEY")
} Try / catch
key, err := parsePrivateKey(contents)
if err != nil {
if strings.Contains(err.Error(), "unsupported private key encoding") {
return fmt.Errorf("re-encode key with: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pem")
}
return err
} Prevention
- Store client keys as unencrypted PKCS#8 PEM ('BEGIN PRIVATE KEY').
- Strip passphrases before deployment or supply them via the supported config mechanism.
- Confirm the key path config points at the key file, not the certificate.
When it happens
Trigger: The client key file is encrypted (PEM with Proc-Type/DEK-Info headers), malformed, or in an unsupported format (e.g. OpenSSL 'traditional' formats not covered, or a PKCS#12 blob passed as a key).
Common situations: Password-protected keys where no passphrase was stripped; keys converted with unusual tooling; accidentally passing the certificate file as the key path.
Related errors
- unsupported private key encoding
- PEM truststore contains no certificates
- JKS keystore contains no private key entry
- PEM truststore contains no certificates
- JKS truststore contains no certificates
AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05).
Data as JSON: /api/errors/c1b4b70b9b30972c.
Report an issue: GitHub.