Teleport Login Fails With a PEM Private Key Error

Teleport refuses to log you in and reports ERROR: expected PEM encoded private key. The cause is a corrupted local credential cache on your own
machine, and clearing that cache fixes it. Nothing in your account or on the
platform side needs changing.

Symptoms

• tsh login or tsh status fails with ERROR: expected PEM encoded private key.
• Teleport Connect cannot connect to the cluster, or repeatedly asks you to
  log in again.
• The problem follows the machine: the same account works fine from a
  different computer.

Cause

The tsh client stores your session keys and certificates in a local folder.
If that folder is partially written, truncated, or left over from an older
client version, the stored key is no longer a valid PEM file and every login
fails until the cache is cleared.

Where the cache lives

Solution — reset the local cache

Renaming rather than deleting is safer, because you can restore the folder if
you need to.

1. Close any terminal or application that is using tsh, including Teleport
   Connect.

2. Log out and check the current state:

   Shell

   tsh logout --proxy teleport.manage.cto2b.eu
   tsh status

3. Rename the cache folders listed above. For example, rename .tsh to
   .tsh.bak, and rename the tsh folder under the Teleport Connect
   application data directory to tsh.bak.

4. Log in again:

   Shell

   tsh login --user <your-username> --proxy teleport.manage.cto2b.eu

Verify it worked

Run:

tsh status

A healthy session shows the proxy teleport.manage.cto2b.eu, your username,
your roles, and a future certificate expiry time, with no PEM error. Listing
your resources confirms the session is usable:

tsh ls

Once you are satisfied that login works, you can delete the .tsh.bak
folders.

Prevention

• Let tsh logout end a session rather than deleting files by hand.
• Keep the tsh client and Teleport Connect on the same major version, and
  reset the cache after a large version upgrade if login starts failing.

Still having issues?

If the error persists after a clean cache reset, raise a request in the
Support Portal or in your dedicated Slack channel with the exact error
text and your operating system. See Getting Help.

Related articles

• Cannot Sign In to SVIEW or Teleport
• Teleport Shows No Resources After Access Is Approved