How do I fix "error:1E08010C:DECODER routines::unsupported"?

Re-encode the key to PKCS#8: `openssl pkcs8 -topk8 -in old.pem -out new.pem` (add `-nocrypt` for an unencrypted key). If the key uses a legacy cipher, re-write it with a modern one: `openssl rsa -in old.pem -out new.pem`. For unavoidable legacy material, start Node with `--openssl-legacy-provider` — a stopgap, not a fix. Rotate any weak keys and store the PKCS#8 version in your Lambda config or secret. Source: https://nodejs.org/api/crypto.html

AWS Lambda / Node.js 18+ (OpenSSL 3)

error:1E08010C:DECODER routines::unsupported

error:1E08010C:DECODER routines::unsupported

What it means

OpenSSL 3, bundled with Node.js 17+, refuses to load a private key stored in a legacy format.

Why it happens

Node.js 18/20/22 ship OpenSSL 3, which disables some legacy algorithms and key encodings by default. Loading an old-format key (e.g. a traditional PKCS#1 PEM or one encrypted with a weak cipher) via `crypto.createPrivateKey`, `https`, JWT signing, or a TLS client then throws `DECODER routines::unsupported` after a runtime upgrade.

How to fix it

Re-encode the key to PKCS#8: `openssl pkcs8 -topk8 -in old.pem -out new.pem` (add `-nocrypt` for an unencrypted key).
If the key uses a legacy cipher, re-write it with a modern one: `openssl rsa -in old.pem -out new.pem`.
For unavoidable legacy material, start Node with `--openssl-legacy-provider` — a stopgap, not a fix.
Rotate any weak keys and store the PKCS#8 version in your Lambda config or secret.

Related deadline: Lambda Node.js 20 Phase 1 — 2027-02-01.

Find every instance in your project

The free EOLkits scanner runs in your browser (nothing uploaded) and flags this and related breakages across your IaC and dependency files.

Primary source: https://nodejs.org/api/crypto.html

Get the full migration audit — $299, hash-anchored PDF →