Error: error:0909006C:PEM routines:get_name:no start line - node

Question

I have cloned this repo (https://github.com/docusign/code-examples-node) and believe I have entered all required keys and codes. But, when I try to authenticate with JWT I get this error:

    at Sign.sign (internal/crypto/sig.js:105:29)
    at Object.sign (C:\Users\BrownJ3\Documents\repos\code-examples-node\node_modules\jwa\index.js:152:45)
    at Object.jwsSign [as sign] (C:\Users\BrownJ3\Documents\repos\code-examples-node\node_modules\jws\lib\sign-stream.js:32:24)
    at Object.module.exports [as sign] (C:\Users\BrownJ3\Documents\repos\code-examples-node\node_modules\docusign-esign\node_modules\jsonwebtoken\sign.js:189:16)
    at generateAndSignJWTAssertion (C:\Users\BrownJ3\Documents\repos\code-examples-node\node_modules\docusign-esign\src\ApiClient.js:62:16)
    at exports.requestJWTUserToken (C:\Users\BrownJ3\Documents\repos\code-examples-node\node_modules\docusign-esign\src\ApiClient.js:890:19)
    at _DsJwtAuth._getToken [as getToken] (C:\Users\BrownJ3\Documents\repos\code-examples-node\lib\DSJwtAuth.js:85:33)
    at log (C:\Users\BrownJ3\Documents\repos\code-examples-node\lib\DSJwtAuth.js:174:33)
    at _DsJwtAuth.DsJwtAuth.login (C:\Users\BrownJ3\Documents\repos\code-examples-node\lib\DSJwtAuth.js:184:5)
    at commonControllers.login (C:\Users\BrownJ3\Documents\repos\code-examples-node\lib\commonControllers.js:36:16) {
  library: 'PEM routines',
  function: 'get_name',
  reason: 'no start line',
  code: 'ERR_OSSL_PEM_NO_START_LINE```

score 65 · Accepted Answer · edited Oct 07 '21 at 07:59

65

What this typically means is that the PEM file is missing the indicator that the key portion has begun.

PEM files are structured like this:

Intitial Data to be processed

-----Begin <Type>-----

Key Information

-----End <Type>-----

The standard for these files can be found here: https://www.rfc-editor.org/rfc/rfc7468

Can you confirm if the -----Begin / End lines are present are present in the PEM file you're using? Please don't post the actual file here, if they are present in the PEM we're going to want to have you open a support case with DocuSign so we keep any necessary private data for troubleshooting private.

edited Oct 07 '21 at 07:59

Community

1
1

answered Jul 22 '20 at 20:29

Matt King DS

1,252
9
6

1

Now I use the PEM file instead of the CRT and it works ... – testing Feb 22 '21 at 11:02
14

I have the startline but still gets the error. -----BEGIN CERTIFICATE----- – Sandeepa Kariyawasam Sep 10 '21 at 11:14
If you end up here and this answer doesn't help you, consider ensuring that the file you are reading is accessible (i.e. no perms issues) – babycakes Sep 28 '22 at 21:14
I have a windows machine,Where do I find this PEM file? – Shubham Oct 18 '22 at 04:40

score 17 · Answer 2 · answered Oct 11 '21 at 06:01

17

If using docker, I have some observations.

Try to make .env values plain text. Not string literal.
When getting the item to code, replace '\\n' with '\n'

answered Oct 11 '21 at 06:01

Henshal B

1,540
12
13

1

I wish I could upvote every time this helps me. – samurai jack Sep 06 '22 at 05:28

score 16 · Answer 3 · answered Sep 12 '22 at 08:51

If you indeed have valid structure of PEM as @Matt King DS suggested, but you still get this error, it is likely that new lines are causing error.

If you are using dotenv then from documentation:

Multiline values

If you need multiline variables, for example private keys, those are now supported (>= v15.0.0) with line breaks:
PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----

...

Kh9NV...

...

-----END DSA PRIVATE KEY-----"
Alternatively, you can double quote strings and use the \n character:
PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nKh9NV...\n-----END DSA PRIVATE KEY---

AWS lambda

I also encountered this error in AWS lambda. Here above approach didn't work for me. I had to have env variable in lambda without double quotes, with \n instead of new lines and in code I had to replace \n by \n, like this:

process.env.MY_PRIVATE_KEY.replace(/\\n/g, '\n')

Saved my life, thanks. Especially lambda part. It's valid for ELB backed NodeJS(NestJS) in my case as well. Private key strings needs to be replaced by \\n. Non of the container or datadog logs are showing this. — Yadigar ZENGİN, Nov 16 '22 at 07:29
Same for me with GitHub Actions using PEM in secrets ‍♂️ — Greg Venech, May 30 '23 at 02:30

Jeff Tian · Answer 4 · 2023-06-08T02:39:38.817

14

You can validate your certificate here: https://www.sslchecker.com/certdecoder.

In my case, I pasted wrongly that missed one dash:

- -----BEGIN CERTIFICATE-----
+ ----BEGIN CERTIFICATE-----

Please note the first five dashes are critical.

Caution

If you don't want to paste into an unknown site, you can try the following command instead, thanks to @Adrian Gonzalez:

openssl x509 -in <cert-name>.pem -noout -text

edited Jun 08 '23 at 02:39

answered Dec 28 '20 at 11:08

Jeff Tian

5,210
3
51
71

7

i am a bit concerned using an unknown site to paste a sensitive private key into it, there is no guarantee of them not to abuse it. but please do correct me if i am wrong on this – Peter Koller Dec 22 '22 at 07:41
1

Yeah do not use this, you can try this instead in your local machine to verify its a valid certificate, it will output the same info as the website. 'openssl x509 -in .pem -noout -text' – Adrian Gonzalez May 08 '23 at 16:31
1

If it were a certificate, it wouldn't be sensitive, but the Q was about [nodjes.crypto.Sign.sign](https://nodejs.org/docs/latest-v18.x/api/crypto.html#signsignprivatekey-outputencoding) which takes a privatekey, and (@AdrianGonzales) `openssl x509` won't work on a privatekey, nor will that website (although some others will, like lapo.it/asn1js); `openssl pkey [-noout] [-text]` will, and there are other subcommands that work for _some_ keys but not all. – dave_thompson_085 Jun 08 '23 at 07:13

score 3 · Answer 5 · answered Sep 22 '22 at 12:21

3

If you have this problem with Angular CLI then ensure that your ssl key paths are valid.

Had the same problem when running :

ng serve --ssl true --ssl-cert ./ssl/server.crt --ssl-key ./ssl/server.key

and it turned out my paths were invalid.

answered Sep 22 '22 at 12:21

ktsangop

1,013
2
16
29

score 2 · Answer 6 · answered Oct 19 '22 at 07:54

I solved it by just running the following lines of code. This can be run anywhere in order to turn the normal \n into actual newlines '\n'

jWtstring = 'your_JWT_string'
jWtstring.replace(/\\n/g, '\n')

After you get the newly line-entered JWT key, you can paste it to SSM or perform the next steps as you wish.

score 1 · Answer 7 · answered Jan 30 '22 at 07:47

1

Try to delete .nprm from -->

C:\Users{username}

then it will works fine

answered Jan 30 '22 at 07:47

shubham kumar shukla

31
1

user16916333 · Answer 8 · 2022-12-12T11:39:27.247

1

const fs = require('fs')
const https = require('https')


https.createServer(
    {    
        key:fs.readFileSync('key.pem'),
        cert: fs.readFileSync('cert.pem'),
    }
).listen(PORT, () => {
    console.log(`server is running on http://localhost:${PORT}`);
})

you need to load the file key.pem before initialize to the "key: key.pem" with readFileSync that belongs to fs module

https.createServer:- https://nodejs.org/api/https.html#httpscreateserveroptions-requestlistener fs.readFileSync:- https://nodejs.dev/en/learn/reading-files-with-nodejs/

edited Dec 12 '22 at 11:39

answered Dec 12 '22 at 11:32

user16916333

11
2

Please, use link formatting: `[link](url)` – SerjantArbuz Dec 23 '22 at 13:01

score 0 · Answer 9 · answered Nov 08 '22 at 12:44

0

For the angular version 14.2.8 use following commands.

ng serve --ssl "Your_project_name" --ssl-key "path_of_key" --ssl-cert "path_of_your_certificate"

Example:-if your key and certificate on a same drive C://your_key or C://your_certificate

answered Nov 08 '22 at 12:44

sagar potdar

598
1
6
22

score 0 · Answer 10 · answered Dec 07 '22 at 10:42

0

you have to use

 const key = new NodeRSA({ b: 512 });
    let keypair = {
        private: key.exportKey(),
        public: key.exportKey("public")
    };

this private key at the time of signing token with RSA

answered Dec 07 '22 at 10:42

Hasnat saghir

1

aris · Answer 11 · 2022-01-16T07:13:03.957

-1

if you just using it as sandbox project you can use: (without private key)

var jwt = require('jsonwebtoken');
var token = jwt.sign({ foo: 'bar' }, 'shhhhh');

if not as sandbox, you have to generate a privteKey.

you can see it on jsonwebtoken docs: https://www.npmjs.com/package/jsonwebtoken

edited Jan 16 '22 at 07:13

answered Jan 15 '22 at 00:38

aris

409
6
8

score -1 · Answer 12 · edited Apr 03 '23 at 18:36

-1

I have exactly the same issue on my M1 Mac Pro.

Solved my problem by:

Search for your .npmrc file and delete it. sudo find ~ -type f -name '*npmrc' rm -rf /Users/<user>/.npmrc
Do some classics like: npm cache verify npm cache clear --force
Finally use the npm install

edited Apr 03 '23 at 18:36

Community

1
1

answered Jul 27 '22 at 14:25

livia-s

27
3

Error: error:0909006C:PEM routines:get_name:no start line - node

12 Answers12

AWS lambda

Caution

Linked