From 8ea3928df43f59c600d2c10a2672a3cc61fae121 Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Thu, 10 Sep 2026 22:48:34 -0400 Subject: [PATCH] crypto/tls: surface private key parsing error from X509KeyPair This can include e.g. an error that mentiones that ML-DSA is not available due to the FIPS 140-3 module version. Change-Id: I6f505d9baff80fee23edf6f8e995dd846a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/777881 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com Reviewed-by: Dmitri Shuralyov Reviewed-by: Daniel McCarney Auto-Submit: Filippo Valsorda Reviewed-by: Roland Shoemaker --- tls.go | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/tls.go b/tls.go index 6efb063..970c99d 100644 --- a/tls.go +++ b/tls.go @@ -829,20 +829,21 @@ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) { // PKCS #1 private keys by default, while OpenSSL 1.0.0 generates PKCS #8 keys. // OpenSSL ecparam generates SEC1 EC private keys for ECDSA. We try all three. func parsePrivateKey(der []byte) (crypto.PrivateKey, error) { - if key, err := x509.ParsePKCS1PrivateKey(der); err == nil { + key, err := x509.ParsePKCS8PrivateKey(der) + pkcs8Err := err // Return the PKCS#8 error if all parsing attempts fail. + if err != nil { + key, err = x509.ParsePKCS1PrivateKey(der) + } + if err != nil { + key, err = x509.ParseECPrivateKey(der) + } + if err != nil { + return nil, fmt.Errorf("tls: failed to parse private key: %w", pkcs8Err) + } + switch key := key.(type) { + case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, *mldsa.PrivateKey: return key, nil + default: + return nil, errors.New("tls: found unknown private key type in PKCS#8 wrapping") } - if key, err := x509.ParsePKCS8PrivateKey(der); err == nil { - switch key := key.(type) { - case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, *mldsa.PrivateKey: - return key, nil - default: - return nil, errors.New("tls: found unknown private key type in PKCS#8 wrapping") - } - } - if key, err := x509.ParseECPrivateKey(der); err == nil { - return key, nil - } - - return nil, errors.New("tls: failed to parse private key") }