[GH-ISSUE #127] ecdsa key support doesn't seem to be compatible with golang 1.11.5 x509 libs #75

New issue

Closed

opened 2026-02-25 22:32:32 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 22:32:32 +03:00

Owner

Originally created by @erikh on GitHub (Feb 4, 2019).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/127

I have the following code in a go program:

func (c *Cert) readKey(filename string) error {
  content, err := ioutil.ReadFile(filename)
  if err != nil {
    return err
  }

  block, _ := pem.Decode(content)

  c.privkey, err = x509.ParseECPrivateKey(block.Bytes) // this is where it's breaking
  if err != nil {
    return err
  }

  c.pubkey = *c.privkey.Public().(*ecdsa.PublicKey)

  return nil
}

mkcert commandline:

mkcert --install
mkcert --ecdsa --cert-file /tmp/localhost-server.pem --key-file /tmp/localhost-server.key localhost 127.0.0.1 ::1

Error message from the above code:

/tmp/localhost-server.key: x509: failed to parse EC private key: asn1: structure error: tags don't match (4 vs {class:0 tag:16 length:19 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false}  @5

I'm not a crypto guy but that code works with golang's generate_cert and even has a test suite designed around that tool. This code typically works with other keys; just not sure what this means and how I can fix it.

Maybe it's me and I'm sorry if I wasted your time, but figured it was worth trying anyway to see if it was the tool. I really like it so far! Desperately needed. Please keep it up.

Originally created by @erikh on GitHub (Feb 4, 2019). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/127 I have the following code in a go program: ```go func (c *Cert) readKey(filename string) error { content, err := ioutil.ReadFile(filename) if err != nil { return err } block, _ := pem.Decode(content) c.privkey, err = x509.ParseECPrivateKey(block.Bytes) // this is where it's breaking if err != nil { return err } c.pubkey = *c.privkey.Public().(*ecdsa.PublicKey) return nil } ``` mkcert commandline: ```bash mkcert --install mkcert --ecdsa --cert-file /tmp/localhost-server.pem --key-file /tmp/localhost-server.key localhost 127.0.0.1 ::1 ``` Error message from the above code: ``` /tmp/localhost-server.key: x509: failed to parse EC private key: asn1: structure error: tags don't match (4 vs {class:0 tag:16 length:19 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} @5 ``` I'm not a crypto guy but that code works with golang's generate_cert and even has a test suite designed around that tool. This code typically works with other keys; just not sure what this means and how I can fix it. Maybe it's me and I'm sorry if I wasted your time, but figured it was worth trying anyway to see if it was the tool. I really like it so far! Desperately needed. Please keep it up.

kerem closed this issue

2026-02-25 22:32:32 +03:00

kerem commented

2026-02-25 22:32:32 +03:00

Author

Owner

@erikh commented on GitHub (Feb 4, 2019):

figured it out; if I'm understanding right, you generate PKCS#8 formatted and those calls work on SEC1 format; I was able to adapt my code to manage both. Anyways, I'll leave this open if you want to deal with those too, but otherwise I got it worked out on my end.

@erikh commented on GitHub (Feb 4, 2019): figured it out; if I'm understanding right, you generate PKCS#8 formatted and those calls work on SEC1 format; I was able to adapt my code to manage both. Anyways, I'll leave this open if you want to deal with those too, but otherwise I got it worked out on my end.

kerem commented

2026-02-25 22:32:32 +03:00

Author

Owner

@FiloSottile commented on GitHub (Feb 5, 2019):

Yeah, in Go you want to use x509.ParsePKCS8PrivateKey instead of x509.ParseECPrivateKey.

I opened golang/go#30094 to improve the error message in the standard library.

@FiloSottile commented on GitHub (Feb 5, 2019): Yeah, in Go you want to use `x509.ParsePKCS8PrivateKey` instead of `x509.ParseECPrivateKey`. I opened golang/go#30094 to improve the error message in the standard library.

kerem referenced this issue

2026-02-25 22:33:20 +03:00

[PR #75] [CLOSED] Added guide for converting mkcert .pem certificates to IIS .pfx certificates #381