Go (RE2)

PEM Private Key Block in GO

Match PEM-encoded private key blocks across the common variants (RSA, EC, DSA, OpenSSH, encrypted, PGP).

Try it in the GO tester →

Pattern

regexGO
-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY-----   (flags: g)

Go (RE2) code

goGo
package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY-----`)
	input := `-----BEGIN RSA PRIVATE KEY-----\nMIIEow...\n-----END RSA PRIVATE KEY-----`
	for _, match := range re.FindAllString(input, -1) {
		fmt.Println(match)
	}
}

Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.

How the pattern works

The optional `(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?` group covers the algorithm prefix variants. [\s\S]+? lazily matches the multiline base64 body. The closing `-----END ... PRIVATE KEY-----` mirrors the opening. This is the canonical pattern for secret-scanning tools.

Examples

Input

-----BEGIN RSA PRIVATE KEY-----\nMIIEow...\n-----END RSA PRIVATE KEY-----

Matches

  • -----BEGIN RSA PRIVATE KEY-----\nMIIEow...\n-----END RSA PRIVATE KEY-----

Input

-----BEGIN OPENSSH PRIVATE KEY-----\nb3Blbn...\n-----END OPENSSH PRIVATE KEY-----

Matches

  • -----BEGIN OPENSSH PRIVATE KEY-----\nb3Blbn...\n-----END OPENSSH PRIVATE KEY-----

Input

-----BEGIN CERTIFICATE-----

No match

—

Same pattern, other engines

JavaScript / ECMAScript

Supported

See how this pattern looks (and behaves) in JavaScript's built-in RegExp.

Python (re)

Supported

See how this pattern looks (and behaves) in Python's stdlib `re` module.

← Back to PEM Private Key Block overview (all engines)