Password was not given but private key is encrypted

The mirror case exists too: "Password was given but private key is not encrypted." — same call, opposite mismatch (both reproduced on cryptography 50.0).

Python cryptography — TypeError from load_pem_private_key

What it means

You called load_pem_private_key(data, password=None) on a key that is encrypted — its PEM says ENCRYPTED PRIVATE KEY, or carries Proc-Type: 4,ENCRYPTED headers. The library can see the encryption envelope and refuses to guess: it needs the passphrase as bytes, or a key that is genuinely unencrypted.

Why it happens

• Key generated with a passphrase, code expects none

  common

  openssl genpkey/ec with -aes256, ssh-keygen with a passphrase, or a CA-issued bundle produce encrypted keys. Deployment code written for plaintext keys then passes password=None and stops here.

• Password available but passed incorrectly

  common

  The parameter must be bytes, not str; an empty string is not the same as None; and a password read from an env var may carry a trailing newline that makes decryption fail later with "Incorrect password, could not decrypt key".

• Wrong key file selected

  occasional

  An encrypted backup copy (key.pem.enc, id_ecdsa with passphrase) picked up instead of the deployment key that was intentionally left unencrypted.

How to fix it

1. 1.

   Supply the passphrase as bytes

   Pass the password through your secret store, encoded to bytes; strip whitespace defensively.

   import os
   from cryptography.hazmat.primitives.serialization import load_pem_private_key
   
   password = os.environ["KEY_PASSPHRASE"].strip().encode()
   key = load_pem_private_key(pem_bytes, password=password)

2. 2.

   Or decrypt the key once, at provisioning time

   If the runtime environment cannot manage a passphrase, store the key unencrypted in a proper secret manager — an encrypted key whose password sits in the same env file adds no protection. And if the passphrase ever traveled next to the key in a repository, rotate the key: at that point the encryption was decoration.

   openssl pkey -in encrypted.pem -out plain.pem
   # (prompts once for the passphrase; protect plain.pem via the secret store)

← Browse the full signature error database