DKIM key generated in PKCS#8 format on first boot — dkimpy cannot parse it, all outbound signing crashes

[sorenmichaelsen]

Summary

On first boot the DKIM private key under /appdata/dkim/dkim.key is generated in PKCS#8 format (-----BEGIN PRIVATE KEY-----), which is the OpenSSL 3.x default. SimpleLogin's DKIM library (dkimpy) can only parse the traditional PKCS#1 format (-----BEGIN RSA PRIVATE KEY-----). As a result, every outbound mail that needs a DKIM signature crashes, and the web UI returns HTTP 500.

This blocks the entire first-run flow: the account activation email, "resend activation", and "forgot password" all fail, so a new self-hosted instance cannot complete sign-up out of the box.

Environment

• Image: jsonbored/simplelogin-aio:latest
• Digest: sha256:76313bcfddc5285ee3bda950371baac88da18222413868afa09942ca669c9ee9
• Likely release: v4.81.4-aio.1 (image built ~6 weeks before this report)
• Note: the org.opencontainers.image.version label reports "22.04", which is the Ubuntu base version, not the AIO release — appears mislabeled
• Host: Unraid

Steps to reproduce

1. Fresh install, let first boot generate the DKIM key.
2. Register an account / trigger any outbound mail (resend activation, forgot password).
3. Observe HTTP 500 and the traceback below.

Actual

dkim.KeyFormatError: Unparsable private key: Unexpected tag (got 30, expecting 02)
... Cannot create DKIM signature

head -1 /appdata/dkim/dkim.key shows -----BEGIN PRIVATE KEY----- (PKCS#8).

Workaround

Convert the key in place, which preserves the same key (public key unchanged):

openssl rsa -in dkim.key -traditional -out dkim.key

After a container restart, outbound signing works.

Suggested fix

Generate the DKIM key in traditional PKCS#1 format at first boot, e.g. openssl genrsa piped through openssl rsa -traditional, or run the conversion automatically if the existing key is detected as PKCS#8.