# Unable to decode the PEM-encoded private key

**URL:** <https://forum.inductiveautomation.com/t/unable-to-decode-the-pem-encoded-private-key/90312>\
**Category:** Ignition\
**Created:** [May 13, 2024, 2:25pm UTC](https://forum.inductiveautomation.com/t/unable-to-decode-the-pem-encoded-private-key/90312 "2024-05-13T14:25:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ken.maze](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ken.maze/32/85876_2.png) [@ken.maze](https://forum.inductiveautomation.com/u/ken.maze)\
**Post date:** [May 13, 2024, 2:25pm UTC](https://forum.inductiveautomation.com/t/unable-to-decode-the-pem-encoded-private-key/90312/1 "2024-05-13T14:25:20Z")

</div>

I have a private key .pfx, two certs .cer, and a password. These work fine when I install into Windows server and enable them through IIS, I am able to reach the websites with https just fine.

However, when I try to install into Ignition, I get

> Validation Error!  
> The Gateway could not validate private key.

I get this same error whether I enable a password and enter it, or if I don't enable the password.

Am I missing something?

Thanks

---

<div class="post-metadata">

**Author:** ![edward.fowler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/edward.fowler/32/24179_2.png) [@edward.fowler](https://forum.inductiveautomation.com/u/edward.fowler)\
**Post date:** [May 24, 2024, 1:57pm UTC](https://forum.inductiveautomation.com/t/unable-to-decode-the-pem-encoded-private-key/90312/2 "2024-05-24T13:57:30Z")

</div>

Hi Ken.  
I'm having the same issue. Did you get this resolved?  
Thanks,  
Ted.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [May 24, 2024, 2:11pm UTC](https://forum.inductiveautomation.com/t/unable-to-decode-the-pem-encoded-private-key/90312/3 "2024-05-24T14:11:34Z")

</div>

Try running the PEM through OpenSSL to display it. This should give you a hint. (It should **not** ask for a password. An empty password is not the same as no password.)

---

<div class="post-metadata">

**Author:** ![ken.maze](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ken.maze/32/85876_2.png) [@ken.maze](https://forum.inductiveautomation.com/u/ken.maze)\
**Post date:** [July 8, 2024, 4:37pm UTC](https://forum.inductiveautomation.com/t/unable-to-decode-the-pem-encoded-private-key/90312/5 "2024-07-08T16:37:58Z")

</div>

Hi, I called support for this, after a couple of tries came up with this procedure:

1. Open the .pfx file with Keystore explorer
2. Export the Private Key as PKCS#8 and include the password.
3. Now in that same pfx file, click Export Certificate Chain and select "Entire Chain" and X.509 as well as PEM. That will generate a .cer file.
4. Now in the wizard, throw the private key file in as your private key and then use the cer for server certificate. It carries the rest of the chain and will auto-populate on the screen.

You have to download Keystore Explorer for this.

Hope that helps