What it means
A PrivateKey, PublicKey or PresharedKey in the config is not a valid 32-byte base64 key.
Why it happens
- The key was cut when copying (it is 44 characters ending in =).
- Quotes, spaces or a line break got into the value.
- A public key pasted where a private key is expected.
How to fix it
- Generate keys again: wg genkey | tee priv | wg pubkey > pub, and paste whole lines.
- Remove quotes and spaces around the value.
- The generator on prefixkit makes matching keys in the browser.
Useful tools
Other WireGuard errors
- Handshake for peer 1 (203.0.113.10:51820) did not complete after 5 seconds, retrying (try
- Packet has unallowed src IP (10.0.0.7) from peer 3 (198.51.100.20:43210)
- RTNETLINK answers: Operation not supported / Unable to access interface: Protocol not supp
- /usr/bin/wg-quick: line 32: resolvconf: command not found
- Unable to modify interface: Address already in use
- Name or service not known: `vpn.example.com:51820' / Configuration parsing error