Password was given but private key is not encrypted.

Python cryptography — TypeError from load_pem_private_key / load_der_private_key

What it means

You passed a `password` to a key loader, but the key is stored unencrypted. cryptography treats this as a programming error (`TypeError`) rather than ignoring the password, because silently accepting it would hide configuration drift — for example a key that someone decrypted and saved in plain text. It is the mirror image of "Password was not given but private key is encrypted".

Why it happens

• A passphrase setting outlived an encrypted key

  common

  The key was re-exported or regenerated without encryption, but the deployment still provides the old passphrase variable. Rotations done by different teams commonly leave this mismatch behind.

• An empty string instead of None

  common

  `password=b""` is a password. Code that reads an unset environment variable as `""` and encodes it passes an empty password for an unencrypted key and gets this error.

• Conversion removed the encryption

  occasional

  `openssl pkey -in enc.pem -out key.pem` (without a cipher option) or `ssh-keygen -p` with an empty new passphrase writes the key unencrypted, while the application still expects to decrypt it.

How to fix it

1. 1.

   Pass None for unencrypted keys

   Normalise empty configuration values to `None`. If keys must be encrypted at rest by policy, treat this error as a signal that an unencrypted key was deployed and replace the key instead.

   import os
   from cryptography.hazmat.primitives import serialization
   
   passphrase = os.environ.get("KEY_PASSPHRASE") or None   # "" becomes None
   key = serialization.load_pem_private_key(pem, password=passphrase.encode() if passphrase else None)

2. 2.

   Detect encryption from the PEM itself

   PKCS#8 encrypted keys use the `ENCRYPTED PRIVATE KEY` label; legacy OpenSSL PEM keys carry a `Proc-Type: 4,ENCRYPTED` header. Use that to decide whether to ask for a passphrase.

   def is_encrypted_pem(pem: bytes) -> bool:
       head = pem.lstrip()[:64]
       return head.startswith(b"-----BEGIN ENCRYPTED PRIVATE KEY-----") or b"Proc-Type: 4,ENCRYPTED" in pem

← Browse the full signature error database