fjordtools / Errors / DECODER routines::unsupported

error:1E08010C:DECODER routines::unsupported

The program tried to read a private key and could not recognise the data as any key format it supports. The usual causes are a file that is not a key, a key cut off while copying, a public key or certificate where a private key is needed, and a key in a format that program does not read.

Fjordtools team · Seen in Node, OpenSSL 3, Python and OpenSSH · Published 8 November 2026 · 2 min read

How the tools word it

Node 26	`error:1E08010C:DECODER routines::unsupported (ERR_OSSL_UNSUPPORTED)`
OpenSSL 3.6 pkey	`Could not find private key of key from key.pem`
Python 3.14 ssl	`ssl.SSLError: [SSL] PEM lib`
ssh-keygen	`Load key "key.pem": invalid format`

Common causes

A file that is not a key
A web page, an error message or a login page saved under the name of a key file. This happens when a download did not follow a redirect.
Input
```
<!DOCTYPE html>
<title>Sign in</title>
```
Key Inspector says
```
No key found. Paste a PEM block (-----BEGIN …), a JWK or JWKS, or an OpenSSH key
```

A key that was cut off

A key copied from a terminal, a chat or a CI log often loses its last lines. The data ends in the middle of a field.

Input

-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIMwNcJ8oAUMCRYB/gsrg0G37
-----END PRIVATE KEY-----

Key Inspector says

PKCS#8 private key: the data ends early. The outer SEQUENCE needs 46 bytes, only 31 are there. Was the key cut off when it was copied?

A format the program does not read

This OpenSSH private key is a valid key. Node's createPrivateKey cannot read the OpenSSH format and gives the error above, and some older tools cannot either. Convert it to PKCS#8 or PEM first.

Input

Key Inspector says

Ed25519 private key · OpenSSH private key

A public key where a private key is needed
The data is a good key, but a public one. Reading it as a private key fails with the same message.
Input
```
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAtzY2YFtLIQMYpRoUoyBMUqnvPaVbLnm4sCZSE1nR9sw=
-----END PUBLIC KEY-----
```
Key Inspector says
```
Ed25519 public key · SPKI PEM
```
An old encryption algorithm
A key protected with an obsolete cipher such as RC2-40 cannot be decrypted by OpenSSL 3 without its legacy provider. OpenSSL reports the algorithm as unsupported, and Node reports ERR_OSSL_EVP_UNSUPPORTED. The Key Inspector shows the algorithm's identifier, 1.2.840.113549.1.12.1.6 for PKCS#12 RC2-40.

How to fix it

Open the file in a text editor. A key starts with a line such as -----BEGIN PRIVATE KEY----- and ends with a matching END line, with nothing cut off in between.
Paste it into the Key Inspector. It names the format, or says where the data ends early.
If the file is an OpenSSH private key, read it with ssh-keygen, or export it as PKCS#8 with the Key Inspector's Convert view.
If you hold only the public key, you cannot sign or decrypt with it. Find or generate the private key.
For an old encryption algorithm, add -provider legacy -provider default to the OpenSSL command, or re-encrypt the key with a modern cipher.

Related errors

More error explainers are coming

See all errors.