Error: Malformed Sequence in RSA Private Key

Issue

When configuring a Snowflake destination with key-pair authentication, the Default Virtual Warehouse drop-down menu is empty, and the setup form returns the following error:

Fetch Select items failed | Exception while parsing Private Key: malformed sequence in RSA private key

Environment

• Destination: Snowflake
• Authentication mode: KEY-PAIR

Resolution

To resolve this issue, do the following:

1. Confirm that you're using a private key in PKCS#8 PEM format, not the public key file (rsa_key.pub). If necessary, generate a new key pair as described in our Snowflake destination setup guide:

   openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
   openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
   

2. If you generated a new key pair, assign the public key to your Snowflake user. Then, in a Snowflake worksheet, use the SYSADMIN or SECURITYADMIN role to run the following command:

   ALTER USER <username> SET RSA_PUBLIC_KEY='<public_key>';
   

3. Open the private key file in a plain-text editor and confirm the following:
   • The key begins with -----BEGIN PRIVATE KEY----- and ends with -----END PRIVATE KEY-----.
   • The original line breaks are intact.
   • The key doesn't contain additional spaces.
4. In Fivetran, go to your Snowflake destination page.
5. In the top right, select the more options menu, then click Edit connection.
6. In the Authentication drop-down menu, confirm that KEY-PAIR is selected.
7. In the Private Key field, paste the entire private key, including the header and footer.
8. Configure the encryption settings:
   • If the key is encrypted, set the Is Private Key encrypted toggle to ON and enter the corresponding Passphrase.
   • If the key isn't encrypted, leave the toggle OFF and the Passphrase field empty.
9. In the Default Virtual Warehouse drop-down menu, select the required warehouse.
10. Click Save & Test.

If the Default Virtual Warehouse drop-down menu remains empty after Fivetran accepts the private key, confirm that the Snowflake user has a default warehouse and that the Fivetran role has USAGE permission on it. For more information, see How Can I Change the Default Virtual Warehouse for an Existing Snowflake Destination?.

If the issue persists, contact our support team.

Cause

This issue occurs when Fivetran can't parse the private key entered in the destination setup form. As a result, we can't authenticate with Snowflake and retrieve the available virtual warehouses.

This may happen when:

• The PEM header or footer is missing or altered.
• The key's line breaks were removed or additional spaces were introduced.
• The key isn't in PKCS#8 PEM format.
• The public key was entered instead of the private key.
• The private key doesn't match the public key assigned to the Snowflake user.
• The key's encryption setting or passphrase is incorrect.