How the tools word it
| Node 26, wrong passphrase | error:1C800064:Provider routines::bad decrypt (ERR_OSSL_BAD_DECRYPT) |
|---|---|
| Node 26, no passphrase | error:07880109:common libcrypto routines::interrupted or cancelled (ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED) |
| OpenSSL 3.6, wrong passphrase | error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:95:maybe wrong password |
| ssh-keygen, wrong passphrase | Load key "key": incorrect passphrase supplied to decrypt private key |
Common causes
A wrong passphrase
The key below is protected with a passphrase. The Key Inspector reads how it is protected but never asks for the passphrase, so it cannot tell you whether yours is right. A program that decrypts it with a wrong one reports bad decrypt.
Input
-----BEGIN ENCRYPTED PRIVATE KEY----- MIGjMF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBBQ/gNMVo056wOgT1HG FzZHAgIIADAMBggqhkiG9w0CCQUAMB0GCWCGSAFlAwQBKgQQ10bE7FlsySR/4+5k zucR5gRAw/ZSDaBoGgzNTswSopxTuXfXRykD9Rr/EvZOvLuXMkY7uwTQTbAoZTNc 7WuEwxgc26zmYDlKGqrA4pREZY9JUw== -----END ENCRYPTED PRIVATE KEY-----
Key Inspector says
Encrypted private key · PKCS#8, PBES2 (PBES2: PBKDF2 with HMAC-SHA256, 2048 rounds, AES-256-CBC)
No passphrase was passed
The program was not given a passphrase at all. Node reports this as interrupted or cancelled, which does not mention a passphrase. Pass it as the passphrase option.
An OpenSSH key with a passphrase
ssh-keygen says incorrect passphrase. The Key Inspector shows the public part of such a key and the cipher that protects the private part.
Input
-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABBeH0yNvX fZ1GaTeDvkjR/3AAAAIAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIPYlpjYlVtAIzqXR 4GBwGxJSo3ScfvQmTCz/g7U6EVTDAAAAkIIcm0aV+Mr+bMoFUWh7KUt3wnPyJIWIWGgVi/ uguKlOeoLntkDKFwo4sglKDSe+vpGz6aRLyf0rFNKva2XJdU4mhIqZJnEu06Xb5GW62qb+ h0JvqozgRTx+RyqyiD2hqGBwfuDc0BNKtVl3rhLryJtzRpNFHxpRWcmrVjCsY83jF2HysL 0lbSTmLMresFwHtw== -----END OPENSSH PRIVATE KEY-----
Key Inspector says
Encrypted private key · Public part shown (aes256-ctr, bcrypt passphrase)
A cipher the program no longer supports
A key encrypted with an obsolete cipher, such as RC2-40, cannot be opened by OpenSSL 3 without its legacy provider. The message is then ERR_OSSL_EVP_UNSUPPORTED in Node and unsupported in OpenSSL, not bad decrypt.
How to fix it
- Type the passphrase again, and check the keyboard layout and a trailing space or line break copied with it.
- Pass the passphrase the way the program expects: openssl pkey -passin pass:... , the passphrase option in Node, or ssh-keygen -P.
- To remove the passphrase, write a copy without it: openssl pkey -in encrypted.pem -out plain.pem, or ssh-keygen -p -N "" -f key.
- Use the Key Inspector to see which cipher protects the key and whether it is an OpenSSH or a PKCS#8 file.
- For an obsolete cipher, add -provider legacy -provider default to the OpenSSL command, and re-encrypt the key with AES.