Message-ID: <gh-pgjdbc-pgjdbc-3942@github.com>
From: "reissseb (@reissseb)" <noreply+reissseb@github.com>
To: "pgjdbc/pgjdbc" <noreply+pgjdbc-pgjdbc@github.com>
Date: Fri, 20 Feb 2026 16:20:50 +0000
Subject: [pgjdbc/pgjdbc] issue #3942: File extension-based format detection breaks DER keys with .key suffix
List-Id: <gh-pgjdbc-pgjdbc.github.com>
X-GitHub-Author-Id: 117629565
X-GitHub-Author-Login: reissseb
X-GitHub-Issue: 3942
X-GitHub-Repo: pgjdbc/pgjdbc
X-GitHub-State: closed
X-GitHub-Type: issue
X-GitHub-Url: https://github.com/pgjdbc/pgjdbc/issues/3942
Content-Type: text/plain; charset=utf-8

This is more of informational purpose for others stumbling upon this problem as well.

It would be nice to update the documentation to clearly state which file format is expected for each file ending.

**Describe the issue**

I updated our Spring Boot application from 3.5.8 to 3.5.11, which includes pgjdbc version v42.7.9.

PR [#3700](https://github.com/pgjdbc/pgjdbc/pull/3700) added PEM support and introduced file extension-based format detection in `LibPQFactory.java`:

```java
} else if (sslkeyfile.endsWith(".key") || sslkeyfile.endsWith(".pem")) {
   initPEM(sslkeyfile, defaultdir, info);
} else {
   initPk8(sslkeyfile, defaultdir, info);
}
```

This change now associates `.key` files with PEM format.

In our case, we were using DER-formatted keys with `.key` extension, which resulted in `MalformedInputException`.

**Solution**

Renaming the key file to use the `.der` extension solved the problem.

**Expected behavior**

Document that `.key` and `.pem` extensions expect PEM text format.

**Driver Version**

v42.7.10

**To Reproduce**

1. Create a DER-formatted private key file with `.key` extension
2. Set `sslkey` parameter in JDBC URL to point to this file
3. Attempt to connect

**Logs**

```
Caused by: org.postgresql.util.PSQLException: Could not load the private key
       at org.postgresql.ssl.PEMKeyManager.getPrivateKey(PEMKeyManager.java:80)
       ...
Caused by: java.nio.charset.MalformedInputException: Input length = 1
       at java.base/java.nio.charset.CoderResult.throwException(Unknown Source)
       at java.base/sun.nio.cs.StreamDecoder.implRead(Unknown Source)
       at java.base/sun.nio.cs.StreamDecoder.read(Unknown Source)
       at java.base/java.io.InputStreamReader.read(Unknown Source)
       at java.base/java.io.BufferedReader.fill(Unknown Source)
       at java.base/java.io.BufferedReader.readLine(Unknown Source)
       at java.base/java.io.BufferedReader.readLine(Unknown Source)
       at java.base/java.nio.file.Files.readAllLines(Unknown Source)
       at java.base/java.nio.file.Files.readAllLines(Unknown Source)
       at org.postgresql.ssl.PEMKeyManager.getPrivateKey(PEMKeyManager.java:50)
```