t8y2/dbx · error · IllegalArgumentException

Unsupported private key format in ${keyPath}. Use PKCS#8 (--

Error message

Unsupported private key format in ${keyPath}. Use PKCS#8 (-----BEGIN PRIVATE KEY-----) or PKCS#1 RSA (-----BEGIN RSA PRIVATE KEY-----).

What it means

Thrown by MongoAgent.loadPrivateKeyFromPem when the PEM file at keyPath has a header the parser does not recognize — only 'BEGIN PRIVATE KEY' (PKCS#8) and 'BEGIN RSA PRIVATE KEY' (PKCS#1) are supported. Commonly hit with PKCS#1 EC keys, encrypted keys, or openssh-format keys; X.509 mTLS client auth cannot proceed.

Source

Thrown at agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java:286

            int octetLen = keyBytes.length;
            byte[] octetLenBytes;
            if (octetLen < 128) {
                octetLenBytes = new byte[] {(byte) octetLen};
            } else if (octetLen < 256) {
                octetLenBytes = new byte[] {(byte) 0x81, (byte) octetLen};
            } else {
                octetLenBytes = new byte[] {(byte) 0x82, (byte) (octetLen >> 8), (byte) (octetLen & 0xff)};
            }
            byte[] pkcs8Key = new byte[pkcs8Header.length + octetLenBytes.length - 1 + keyBytes.length];
            int pos = 0;
            System.arraycopy(pkcs8Header, 0, pkcs8Key, pos, pkcs8Header.length - 1);  // exclude placeholder OCTET STRING length
            pos += pkcs8Header.length - 1;
            System.arraycopy(octetLenBytes, 0, pkcs8Key, pos, octetLenBytes.length);
            pos += octetLenBytes.length;
            System.arraycopy(keyBytes, 0, pkcs8Key, pos, keyBytes.length);
            return KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(pkcs8Key));
        } catch (Exception e) {
            throw new IllegalArgumentException(
                "Unsupported private key format in " + keyPath
                    + ". Use PKCS#8 (-----BEGIN PRIVATE KEY-----) or PKCS#1 RSA (-----BEGIN RSA PRIVATE KEY-----).",
                e);
        }
    }

    static String firstNonBlank(String... values) {
        for (String value : values) {
            if (value != null && !value.isBlank()) {
                return value;
            }
        }
        return null;
    }

    static String authenticationDatabase(JsonObject connObj) {
        String authSource = urlParam(stringOrNull(connObj, "url_params"), "authSource");
        if (authSource != null && !authSource.isBlank()) {

View on GitHub (pinned to c0390bff16)

Solutions

1. Convert the key to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem
2. For RSA keys in another format convert to PKCS#1: openssl rsa -in key.pem -out key-rsa.pem
3. Remove PEM encryption (openssl rsa -in key.pem -out key-plain.pem) since encrypted PEM is not supported
4. Confirm the file actually contains a private key block and you passed the key path, not the certificate path

When it happens

Trigger: Thrown at agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java:286 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/62ea57b9dd1b355a. Report an issue: GitHub.