t8y2/dbx · error

unsupported private key encoding

Error message

unsupported private key encoding

What it means

parsePrivateKey attempts to decode a private key as PKCS#8, then PKCS#1, then EC SEC1 formats. If none parse, it returns this error. The key bytes are in a format the Go stdlib parsers in this function do not handle.

Source

Thrown at agents/drivers/argo-go/zookeeper_tls.go:239

		certificates = append(certificates, certificate)
	}
	if len(certificates) == 0 {
		return nil, errors.New("PEM truststore contains no certificates")
	}
	return certificates, nil
}

func parsePrivateKey(contents []byte) (any, error) {
	if value, err := x509.ParsePKCS8PrivateKey(contents); err == nil {
		return value, nil
	}
	if value, err := x509.ParsePKCS1PrivateKey(contents); err == nil {
		return value, nil
	}
	if value, err := x509.ParseECPrivateKey(contents); err == nil {
		return value, nil
	}
	return nil, errors.New("unsupported private key encoding")
}

View on GitHub (pinned to c0390bff16)

Solutions

1. Decrypt the key so it is unencrypted PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem (supply the passphrase once)
2. Convert to PKCS#8 explicitly: openssl pkey -in key.pem -out key.pkcs8.pem
3. Verify the PEM header is 'BEGIN PRIVATE KEY' or 'BEGIN RSA PRIVATE KEY', not 'BEGIN ENCRYPTED PRIVATE KEY'
4. Confirm the file actually holds a private key, not a CSR or public key

Example fix

// before
-----BEGIN ENCRYPTED PRIVATE KEY-----
// after
# openssl pkcs8 -topk8 -nocrypt -in encrypted-key.pem -out key.pem
-----BEGIN PRIVATE KEY-----

block, _ := pem.Decode(keyPEM)
if block == nil || strings.Contains(block.Type, "ENCRYPTED") {
    return fmt.Errorf("private key must be unencrypted PKCS8/PKCS1/EC PEM")
}

key, err := parsePrivateKey(contents)
if err != nil && strings.Contains(err.Error(), "unsupported private key encoding") {
    // re-encode: openssl pkey -in key.pem -out key.pkcs8.pem
}

When it happens

Trigger: loadClientKeyStore encounters a PEM PRIVATE KEY block whose DER payload is not PKCS8/PKCS1/EC — most commonly an encrypted PKCS#8 key ('ENCRYPTED PRIVATE KEY') or a passphrase-protected key, or garbage/truncated PEM content.

Common situations: Key generated with a passphrase and never decrypted; a key in OpenSSL 'traditional' format from an unusual cipher; file corrupted during secret templating; passing a public key or CSR file instead of the private key.

Related errors

• unsupported private key encoding
• JKS keystore contains no private key entry
• PEM truststore contains no certificates
• Hive CA certificate contains no certificates
• JKS keystore contains no private key entry

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/c48a60711c6522e8. Report an issue: GitHub.