How to generate a valid VAPID private key?

Questions
1

Your question

I have generated a Vapid private key online and locally. Both keys are not accepted by the webui.
The Online version I used was VAPID Key Generator - Generate Web Push Keys | RandomKeygen.
The local command was : openssl ecparam -name prime256v1 -genkey -noout -out vapid_private.pem

When I reload the server settings I get the following error message: Action failed

Invalid Web Push VAPID key: PKCS#8 ASN.1 error: PEM error: unexpected PEM type label: expecting “PRIVATE KEY”

So, can anybody tell me or describe how to generate a valid VAPID key for Push notifications?

Thanks in advance

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

The error is a format mismatch: openssl ecparam -genkey (and the online randomkeygen base64 values) produce a SEC1 key labelled -----BEGIN EC PRIVATE KEY----- or a raw application-server key, but Stalwart wants a PKCS#8 key labelled -----BEGIN PRIVATE KEY----- on the P-256 curve with named-curve encoding.

Any of these produce an accepted key:

openssl ecparam -genkey -name prime256v1 -noout -out k.pem

openssl pkey -in k.pem -out vapid_pkcs8.pem

or in one step:

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve

Use vapid_pkcs8.pem, and paste the whole -----BEGIN/END PRIVATE KEY----- block with no leading BOM or whitespace. Worth knowing: the server generates a valid VAPID key automatically on first startup, so you may already have one under the JMAP push settings and not need to make one at all. (See the VAPID key quirks thread for the same encoding gotchas.)