AWS Lambda / Node.js 18+ (OpenSSL 3)

error:1E08010C:DECODER routines::unsupported

error:1E08010C:DECODER routines::unsupported

What it means

OpenSSL 3 can reject malformed key data or material that depends on an unavailable legacy decoder, encryption algorithm, or provider.

Why it happens

Node.js 18 and later Lambda runtimes use OpenSSL 3. This error can mean that the input is not the expected key, its PEM/DER encoding is malformed, it is encrypted with an unsupported legacy algorithm, or the required provider is unavailable. The error alone does not prove that every PKCS#1 key is incompatible.

How to fix it

  1. Confirm that the secret contains the expected complete PEM, including newlines and matching BEGIN/END labels; do not print private material to logs.
  2. Validate it locally with `openssl pkey -in old.pem -check -noout` using an OpenSSL 3 environment.
  3. If validation identifies a legacy encrypted encoding, convert it to a currently supported encoding such as PKCS#8, then verify the converted key before deployment.
  4. Prefer rotating weak or ambiguously sourced key material and storing the replacement in a secret manager. Treat `--openssl-legacy-provider` only as a short-lived diagnostic workaround.

Related deadline: Lambda Node.js 20 create/update restrictions — 2027-02-01.

Check configured patterns in your project

The free EOLkits scanner processes files in your browser and flags selected related patterns in supported IaC and dependency files. File names and contents are not uploaded; bounded aggregate file and finding counts may be sent. It is not a complete source or AWS-account scan.

Prefer a 10-second check? Paste your config into the free AWS EOL checker. Pasted input is not uploaded; bounded first-party usage events may be sent.

Primary source: https://nodejs.org/api/crypto.html

Inspect the $299 report sample and availability →