From c3e4ef226101a142d648d3f7a0208c638bf62ef1 Mon Sep 17 00:00:00 2001
From: Jack Peterson <jackdpeterson@users.noreply.github.com>
Date: Thu, 27 Jun 2019 10:50:28 -0700
Subject: [PATCH] documentation enhancement re: SSH private keys

The default ssh-keygen command creates unreadable SSH keys for spring-cloud-config. This change provides the exception that people are searching with as well as a resolution to the issue.
---
 docs/src/main/asciidoc/spring-cloud-config.adoc | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/docs/src/main/asciidoc/spring-cloud-config.adoc b/docs/src/main/asciidoc/spring-cloud-config.adoc
index 1070b1e3..11cdba68 100644
--- a/docs/src/main/asciidoc/spring-cloud-config.adoc
+++ b/docs/src/main/asciidoc/spring-cloud-config.adoc
@@ -318,6 +318,19 @@ system properties (`-Dhttps.proxyHost` and `-Dhttps.proxyPort`).
 
 TIP: If you do not know where your `~/.git` directory is, use `git config --global` to manipulate the settings (for example, `git config --global http.sslVerify false`).
 
+JGit requires RSA keys in PEM format. Below is an example ssh-keygen (from openssh) command that will generate a key in the corect format:
+
+```bash
+ssh-keygen -m PEM -t rsa -b 4096 -f ~/config_server_deploy_key.rsa
+```
+
+Warning: When working with SSH keys, the expected ssh private-key must begin with ```-----BEGIN RSA PRIVATE KEY-----```. If the key starts with ```-----BEGIN OPENSSH PRIVATE KEY-----``` then the RSA key will not load when spring-cloud-config server is started. The error looks like:
+```
+- Error in object 'spring.cloud.config.server.git': codes [PrivateKeyIsValid.spring.cloud.config.server.git,PrivateKeyIsValid]; arguments [org.springframework.context.support.DefaultMessageSourceResolvable: codes [spring.cloud.config.server.git.,]; arguments []; default message []]; default message [Property 'spring.cloud.config.server.git.privateKey' is not a valid private key]
+```
+
+To correct the above error the RSA key must be converted to PEM format. An example using openssh is provided above for generating a new key in the appropriate format.
+
 ===== Authentication with AWS CodeCommit
 
 Spring Cloud Config Server also supports https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html[AWS CodeCommit] authentication.