`importPkcs8DerOrThrow`

Import a private key from DER-encoded PKCS#8 PrivateKeyInfo.

When algorithm is omitted, the algorithm (and, for EC keys, the curve) is inferred from the PrivateKeyInfo's own privateKeyAlgorithm — useful for keys whose type isn't known ahead of time. Pass algorithm to additionally assert that the DER matches an expected algorithm.

An RFC 5958 v2 OneAsymmetricKey carrying attributes [0] or publicKey [1] is reduced to its v1 fields for the platform import, which Bun 1.3.14 and earlier rejects outright (oven-sh/bun#35432). A publicKey [1] field is checked against the private key it accompanies.

function importPkcs8DerOrThrow(
	der: Uint8Array,
	algorithm?: PrivateKeyImportInput,
): Promise<CryptoKey>

Parameters

der: Uint8Array — DER-encoded PKCS#8 PrivateKeyInfo bytes
algorithm?: PrivateKeyImportInput — Optional expected algorithm; must match key contents when given

Returns — Extractable CryptoKey with sign usage

Throws

Error — If DER is malformed, encodes an unsupported algorithm, doesn't match algorithm, or carries a publicKey [1] that is not the private key's own

See also

exportPkcs8Der for the inverse operation
importPkcs8Pem for PEM input
importEncryptedPkcs8Der for encrypted PKCS#8

importPkcs8DerOrThrow ​