Invalid private key - secrets #3162

New Issue

adam · 2025-12-29T18:26:14+01:00

adam commented

2025-12-29 18:26:14 +01:00

Originally created by @squigley on GitHub (Jan 15, 2020).

Environment

Python version: 3.6.8
NetBox version: 2.6.12

Steps to Reproduce

Add a preexisting public key to the admin's profile
Attempt to add a secret to a device, click create, get prompted for the private key to get a session key
Provide the private key which matches the public key in the admin's profile (with header/footer, without header/footer, with newlines, without newlines..)
Box goes away
Click create again, get prompted for the private key again.

Expected Behaviour

System would accept my private key matching the public key in the profile, give me a session key, and allow me to save the secret.

Observed Behaviour

Just keeps prompting for the private key.
Using the dev tools I see that in response to submitting the private key, I am getting a 400 error, with the text "Invalid Private Key."
It doesn't matter what format I try submitting the private key, eg including the BEGIN/END lines etc, and with the encoded body as one long line, or split after x number of characters, every attempt is invalid.

I was having this issue with 2.6.7, so I upgraded to 2.6.12, deleted the public key from the profile, readded it, but there was no change. I have tried using both Firefox and Chrome, and both fail.

Originally created by @squigley on GitHub (Jan 15, 2020). ### Environment * Python version: 3.6.8 * NetBox version: 2.6.12 ### Steps to Reproduce 1. Add a preexisting public key to the admin's profile 2. Attempt to add a secret to a device, click create, get prompted for the private key to get a session key 3. Provide the private key which matches the public key in the admin's profile (with header/footer, without header/footer, with newlines, without newlines..) 4. Box goes away 5. Click create again, get prompted for the private key again. ### Expected Behaviour System would accept my private key matching the public key in the profile, give me a session key, and allow me to save the secret. ### Observed Behaviour Just keeps prompting for the private key. Using the dev tools I see that in response to submitting the private key, I am getting a 400 error, with the text "Invalid Private Key." It doesn't matter what format I try submitting the private key, eg including the BEGIN/END lines etc, and with the encoded body as one long line, or split after x number of characters, every attempt is invalid. I was having this issue with 2.6.7, so I upgraded to 2.6.12, deleted the public key from the profile, readded it, but there was no change. I have tried using both Firefox and Chrome, and both fail.

adam added the type: bug status: accepted labels 2025-12-29 18:26:14 +01:00

adam closed this issue

2025-12-29 18:26:14 +01:00

adam commented

2025-12-29 18:26:14 +01:00

@hSaria commented on GitHub (Jan 15, 2020):

I tried to recreate this but wasn't able to. What do you mean by preexisting, like one you've generated elsewhere? If you navigate to /user/user-key/, does it say that the user key is active?

Here's a dummy private and public key pair. It works with those

private

Generated with openssl genrsa -out private.pem 2048

public

Generated with openssl rsa -in private.pem -outform PEM -pubout -out public.pem

@hSaria commented on GitHub (Jan 15, 2020): I tried to recreate this but wasn't able to. What do you mean by preexisting, like one you've generated elsewhere? If you navigate to `/user/user-key/`, does it say that the user key is active? Here's a dummy private and public key pair. It works with those <details> <summary>private</summary> Generated with `openssl genrsa -out private.pem 2048` ``` -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA4GDcjN87MbuvRoTpNOG0RT9UA/ThzlrTJXSEuoRnLdl1KGME g76VDrx0cHrXtBQh63Vqx0P0RNRfiPhJQO6/GjifY5gmJhJqG5Zlv95atH2NrCdY mW0IEUslceuV2NS0PA9v6oP/5hU4cb39Y3KC5REu7LX7qunz75HTTWncnnNfmxZo DZN8nJKcoI3L+/PLukQlQrA0dTQJTbOBlkI37QTHt71w+sSEzDqMtR8OEyER4VUo BWkqf6T8PttbvtK993PhRTd5sg/7rtixpJAP5T96O6icMKamEemZbOdKKu20MKxn Dbn2VPHmRoy3Huqf7TjzEyQMTEAWYEZJggUcwwIDAQABAoIBAA0b+6bLYBT+xzXS jCGH0lV9ZrY4d3zr94wnq52OIM0f+GVcq6Xa27CZuB/ePX4K8xRjrtJnmPzwf4hs ITOG/2lTx5Q1Dn2I8+QavGUiY6BJ+Z4GSnnkUeVYw55NSlr5ynH74OkNv0S9Fqgm lohZ52XkxB4WX9bThmoH1hWeysIDFZtapuvPoyZqdP/D+g2fCK/u3CEvsLbulQfY PSRbnzVnunNLawH5KPvmb8rc1+wyY21sDjfGQkSKeGy9b2CSMwqNhFwzJm8YCTEw s1h0JVZd2S1lRX87wEuPSk1v9CKqN5+YhOmhoA1BXV1Qb6UirmscYd3xcQC8aZW3 04WPcgkCgYEA+N8HVJo5yEtyxU25GYcpOF8kGWJK5RO3d+e/y2F830YiqK3nkabh rcuSrJZ5fDeYiRDa0WdgbNT3qzztkBOPuMTdgfypD53qI+p55eo0JBSS7KbB2ZJ4 cdMJuuLd3itfUsJlMj1rSTsDGIDkF0U/bqBaLtTrcwdVVbcFdHrxwa0CgYEA5s46 HT9uXbtjaDC8GvuBNiho/AcvfvE2PFN7KtVyZ34aoEYVXhCMdkE2cAud1Bx/qtuc ZKs9fTqSxqnz8E6Oy+qtcbA4H/vHr/ipGzZIAunvG4FZS6S3S33Q1d2oxgPPv6V+ VI+vtWZS6nnJuNEn6bWEPfhVaw7vRwmRg5GKhi8CgYEA5kxM1kdZjTX0YQyJa0we IuI3352LvOw/7R9x5lyyV1Lpo7o5/hi14kPt2PPuO7qe1sfYFctZ+ZwiDD33gEn5 x3u1lyIduCvjjZTfdJkD4xd+1quB2zqlZn9qE5z4vyzXqxfk2Vbovv1y4ev0JmyY RGDy0z+JGgsBNq6Ex8M1kIkCgYBehicWw1uX156mlQ70nfwVCge079xryK3Flwri R/hKmkKdURZ/J5fe9mYtDRTeQa2nc7lhISBVoR9rbT8SM5oXuUy/OsRBlQP69YOM OXbUeqoKQbcoW5UVvblBXT45mmYCvuw2BYKYcAeVL7uFjWMjO8uk9YdGCR/FoA2Q LJLm0QKBgQDn67F0j+id/mq4eSeP1OJGxrjdmOmJOBpaOqku2CmUtmvkS88E3XOW Bwn2dcn2mm0YEdPN284EVr0iDylgoGqJRDvX8MkLCrjOqbJaq4Clfxb9jkDPglKG wJgxfdNlhtzTS/fX77wYfTRQjNvmf7SiXTZx9OMfk2/HRErBBgxz7g== -----END RSA PRIVATE KEY----- ``` </details> <details> <summary>public</summary> Generated with `openssl rsa -in private.pem -outform PEM -pubout -out public.pem` ``` -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4GDcjN87MbuvRoTpNOG0 RT9UA/ThzlrTJXSEuoRnLdl1KGMEg76VDrx0cHrXtBQh63Vqx0P0RNRfiPhJQO6/ GjifY5gmJhJqG5Zlv95atH2NrCdYmW0IEUslceuV2NS0PA9v6oP/5hU4cb39Y3KC 5REu7LX7qunz75HTTWncnnNfmxZoDZN8nJKcoI3L+/PLukQlQrA0dTQJTbOBlkI3 7QTHt71w+sSEzDqMtR8OEyER4VUoBWkqf6T8PttbvtK993PhRTd5sg/7rtixpJAP 5T96O6icMKamEemZbOdKKu20MKxnDbn2VPHmRoy3Huqf7TjzEyQMTEAWYEZJggUc wwIDAQAB -----END PUBLIC KEY----- ``` </details>

adam commented

2025-12-29 18:26:14 +01:00

@squigley commented on GitHub (Jan 15, 2020):

Oh. I was trying to use my existing SSH private and public keys, and while it is an RSA key, I guess it is not in the PEM format which is required.

After using your generation commands to create a new private and public key in PEM format, and loading them into Netbox, I now get "session key received!" and am able to create and unlock secrets.

Can I suggest that the Secrets documentation page at https://netbox.readthedocs.io/en/stable/core-functionality/secrets/ be modified to add a note that SSH keys can't be used, or if they can, how to convert them into the correct format?

I think I got lead down the wrong path when I read the line "you can either generate a new RSA key pair, or upload the public key belonging to a pair you already have.", and I presumed this meant I could use my existing SSH key pair.

Thanks for the quick reply, which resolved my issue.

@squigley commented on GitHub (Jan 15, 2020): Oh. I was trying to use my existing SSH private and public keys, and while it is an RSA key, I guess it is not in the PEM format which is required. After using your generation commands to create a new private and public key in PEM format, and loading them into Netbox, I now get "session key received!" and am able to create and unlock secrets. Can I suggest that the Secrets documentation page at https://netbox.readthedocs.io/en/stable/core-functionality/secrets/ be modified to add a note that SSH keys can't be used, or if they can, how to convert them into the correct format? I think I got lead down the wrong path when I read the line "you can either generate a new RSA key pair, or upload the public key belonging to a pair you already have.", and I presumed this meant I could use my existing SSH key pair. Thanks for the quick reply, which resolved my issue.

adam commented

2025-12-29 18:26:15 +01:00

@jeremystretch commented on GitHub (Jan 15, 2020):

I'm going to treat this as a bug, since we should be validating the key format on input. (But the docs also need to be improved.)

@squigley Would you mind generating a new key pair in the same format as the one you tried and posting it here to assist with testing? I'm pretty sure I know what's going on but it would help to be sure.

@jeremystretch commented on GitHub (Jan 15, 2020): I'm going to treat this as a bug, since we should be validating the key format on input. (But the docs also need to be improved.) @squigley Would you mind generating a new key pair in the same format as the one you tried and posting it here to assist with testing? I'm pretty sure I know what's going on but it would help to be sure.

adam commented

2025-12-29 18:26:15 +01:00

@squigley commented on GitHub (Jan 15, 2020):

Sure, the keypair I was trying to use was one which was generated by "ssh-keygen", with no parameters. eg:

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/squigley/.ssh/id_rsa): /tmp/id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /tmp/id_rsa.
Your public key has been saved in /tmp/id_rsa.pub.
The key fingerprint is:
SHA256:K/717DPH8CaAuoRhpoaxCtGwBX0bU9rw5vOMVobJoBg squigley@9K771Z2L

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDzWu/eCYGNvKE1jfeoPIzW+lVnWxRIvlAanFvbdfbX563sR2SflIYUI555ZcADYUlF00c6OTraqe734AGDMe2o74mn2ByHwRYGnJMRpBzED3VxHRqKjsCODM440qXwLWnwmkxQLo71GH66UmfyX68CX2wI684QRXpelkikAZzHum2IcRIhBs2E1wtxTUkBUkHxcxux2EkZROm+Qog00pjS31bnsaW5NitJOJImHCV7e7sirAXScx8MO7monJj5T03g6d0gucEPDS/6lBgFhpZ9PA46dLkeq9LoDJdvZGksIkwkBK7eaCXdFTapGVbiFO8cewKkhr/wW3+2Idnl/9L+/DQWl1H85gVCc+f0Q9YwqqXSIo8B5aU30hOHcVqit1K8Sr5XXUGH5pI5+r3OzZcemOEZZVy64Mtawii7KMfa4/Ywg07xsV34f+/VexBh9s264VH83jYaM6+LUv1D16ijVQpJZLsfSDHxnCCQntjPIm5ezWPW2+8c4wz8NcKDDDs= squigley@9K771Z2L

@squigley commented on GitHub (Jan 15, 2020): Sure, the keypair I was trying to use was one which was generated by "ssh-keygen", with no parameters. eg: $ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/squigley/.ssh/id_rsa): /tmp/id_rsa Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /tmp/id_rsa. Your public key has been saved in /tmp/id_rsa.pub. The key fingerprint is: SHA256:K/717DPH8CaAuoRhpoaxCtGwBX0bU9rw5vOMVobJoBg squigley@9K771Z2L -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEA81rv3gmBjbyhNY33qDyM1vpVZ1sUSL5QGpxb23X21+et7Edkn5SG FCOeeWXAA2FJRdNHOjk62qnu9+ABgzHtqO+Jp9gch8EWBpyTEaQcxA91cR0aio7AjgzOON Kl8C1p8JpMUC6O9Rh+ulJn8l+vAl9sCOvOEEV6XpZIpAGcx7ptiHESIQbNhNcLcU1JAVJB 8XMbsdhJGUTpvkKINNKY0t9W57GluTYrSTiSJhwle3u7IqwF0nMfDDu5qJyY+U9N4OndIL nBDw0v+pQYBYaWfTwOOnS5HqvS6AyXb2RpLCJMJASu3mgl3RU2qRlW4hTvHHsCpIa/8Ft/ tiHZ5f/S/vw0FpdR/OYFQnPn9EPWMKql0iKPAeWlN9ITh3FaordSvEq+V11Bh+aSOfq9zs 2XHpjhGWVcuuDLWsIouyjH2uP2MINO8bFd+H/v1XsQYfbNuuFR/N42GjOvi1L9Q9eoo1UK SWS7H0gx8ZwgkJ7YzyJuXs1j1tvvHOMM/DXCgww7AAAFiM4tH23OLR9tAAAAB3NzaC1yc2 EAAAGBAPNa794JgY28oTWN96g8jNb6VWdbFEi+UBqcW9t19tfnrexHZJ+UhhQjnnllwANh SUXTRzo5Otqp7vfgAYMx7ajviafYHIfBFgackxGkHMQPdXEdGoqOwI4MzjjSpfAtafCaTF AujvUYfrpSZ/JfrwJfbAjrzhBFel6WSKQBnMe6bYhxEiEGzYTXC3FNSQFSQfFzG7HYSRlE 6b5CiDTSmNLfVuexpbk2K0k4kiYcJXt7uyKsBdJzHww7uaicmPlPTeDp3SC5wQ8NL/qUGA WGln08Djp0uR6r0ugMl29kaSwiTCQErt5oJd0VNqkZVuIU7xx7AqSGv/Bbf7Yh2eX/0v78 NBaXUfzmBUJz5/RD1jCqpdIijwHlpTfSE4dxWqK3UrxKvlddQYfmkjn6vc7Nlx6Y4RllXL rgy1rCKLsox9rj9jCDTvGxXfh/79V7EGH2zbrhUfzeNhozr4tS/UPXqKNVCklkux9IMfGc IJCe2M8ibl7NY9bb7xzjDPw1woMMOwAAAAMBAAEAAAGASWVl7vvC/TKlFHfq9+y7NaNu2q tXpNDxa/U4pyoe9uNDS34E1TSAc9aCV27eyKYw6URduSvFmmmiT1RaYG1QlqEYTW0avb74 m6nhmXJ70o4vB5yVgrCnVrB6Ch1OOvAXgZ+n4I8KQtXOcvejrjA5omeRN+eW0MWDsL92zT BHTt3lZz9jDl704VnSc6uxlxpuFRp4gd0PvvVP4jhCyFu0B/WgSmUD7KZvy7eqLKBUlbet qzli0CQ0ewYQatBAOwE1j0fSgle965GFbCsL2qti5MgOgXuuyn/tW+0IAx3c+5k3Auli4M 00Ald8etWTmmGDVSNhYbO9JZsV9c+4dn8EYUp3WrUUT1klIqxCZfKSZV5QimI93SDhrHMy deh/JsIh4GqagJPFysy/HFHg9s9Q6Vy3Nzo6Gp4pHggOFldva1SR+ZducKI3lbF4N99OYt 8otUAH/t2SONavOVg2nSiN+h8J613/ZPjtxbOy607hZ4VeksmsaQf3jpqSRbAwP0cxAAAA wQDeRthh/J8T/MG30BeRKDhUJ3leJHLYaPvoVp/3jYTMvQ+m6pLIUntqBQYMFmRx6u9Pzn 1ix53GEBDMXOAr+XGfkpom9vhJYoF4iSpnm4XDYuxW9su8spUVmyEmvuGQkOQ8z2iYW4wq KJSn4gKLYLLA1StDcucCuJn2gjax72ECUfNC96vkvFlFkyqs4hoU6PpFjEmLwvjkdGHFYA i7VNagMT9h2kzJjKxm1m2FcgUJJpWY8Y2/8KBl6Djjz8fH3WIAAADBAP5tkKBWiyHOAOmL 0WSwlGUYrWRGb4V9HBh/io9srLIaCHJyMn8sITsLBzKqExuNpthaTWE5wEJOc8u+d0EwDc 6u1KhDJ1lBg/dw3fd7rw+flBTJezdsdhZ6VsnOWr9bHnx52bgrL18EeRd7lD+V8l4YfUao g8fuFaSIkI5WhAScE5CYIZ/OwXd35sqTFknZI8LrNQ206u40qjhI6zcOxD/TCThAjjCkcA F7JoV/JbDZRbN+9Z7/21eOH3ONhL9XzQAAAMEA9Nvbo8STrcqiFIXubpgHHggjMXyWwuCK XOzDTumDoF3DNnnG6ylowRQElsLL5Yu9x6eAOa0dMSSzoFXi4xbc4tCxZiNGOG/WfZUeUZ Nvh2cn51Oia92gNK5YZ2Sce1e9lInoIR8uzRNkk5pEJyk+vKWUSd+DsOrxPA0KJLhJjTv6 lTp3RbPGmQEESPM9zXF3Pr6wsxkDLpMiO1hm4/+IbI+NCrfqr3vbccEt3MksmTYyVDeRin WsvzeK3Z0AC1wnAAAAEXNxdWlnbGV5QDlLNzcxWjJMAQ== -----END OPENSSH PRIVATE KEY----- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDzWu/eCYGNvKE1jfeoPIzW+lVnWxRIvlAanFvbdfbX563sR2SflIYUI555ZcADYUlF00c6OTraqe734AGDMe2o74mn2ByHwRYGnJMRpBzED3VxHRqKjsCODM440qXwLWnwmkxQLo71GH66UmfyX68CX2wI684QRXpelkikAZzHum2IcRIhBs2E1wtxTUkBUkHxcxux2EkZROm+Qog00pjS31bnsaW5NitJOJImHCV7e7sirAXScx8MO7monJj5T03g6d0gucEPDS/6lBgFhpZ9PA46dLkeq9LoDJdvZGksIkwkBK7eaCXdFTapGVbiFO8cewKkhr/wW3+2Idnl/9L+/DQWl1H85gVCc+f0Q9YwqqXSIo8B5aU30hOHcVqit1K8Sr5XXUGH5pI5+r3OzZcemOEZZVy64Mtawii7KMfa4/Ywg07xsV34f+/VexBh9s264VH83jYaM6+LUv1D16ijVQpJZLsfSDHxnCCQntjPIm5ezWPW2+8c4wz8NcKDDDs= squigley@9K771Z2L

Sign in to join this conversation.

Branches Tags

main

21142-device-component-graphql-filters

21050-device-oob-ip-may-become-orphaned

21102-fix-graphiql-explorer

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#3162