What causes "failed to create ES verifier for algorithm %s: %w" in VictoriaMetrics/VictoriaMetrics?

Inspect the wrapped inner error for the concrete reason from newVerifierES.

failed to create ES verifier for algorithm %s: %w

Error message

failed to create ES verifier for algorithm %s: %w

What it means

After mapping an ECDSA key's curve to an ES algorithm, NewVerifierPool calls newVerifierES to instantiate the verifier. If that constructor fails, pool creation is aborted with this wrapped error naming the algorithm.

Source

Thrown at lib/jwt/verifier_pool.go:75

					return nil, fmt.Errorf("failed to create RSA-PSS verifier for algorithm %s: %w", alg, err)
				}
				vs = append(vs, &verifier{
					Verifier: v,

					key: k,
					alg: alg,
				})
			}

		case *ecdsa.PublicKey:
			alg := getAlgorithmForKey(k)
			if alg == "" {
				return nil, fmt.Errorf("failed to create ECDSA verifier: unsupported key")
			}

			v, err := newVerifierES(alg, k)
			if err != nil {
				return nil, fmt.Errorf("failed to create ES verifier for algorithm %s: %w", alg, err)
			}
			vs = append(vs, &verifier{
				Verifier: v,

				key: k,
				alg: string(alg),
			})
		default:
			return nil, fmt.Errorf("unknown key type: %T", key)
		}
	}

	return &VerifierPool{
		vs: vs,
	}, nil
}

// Verify verifies a token signature by using keys provided to verifier pool

View on GitHub (pinned to 5079fb58f1)

Solutions

Inspect the wrapped inner error for the concrete reason from newVerifierES.
Re-load or re-serialize the ECDSA key to ensure x/y coordinates match the declared curve.
Validate the key with key.Validate() before passing it to NewVerifierPool.

Example fix

// before
pool, err := jwt.NewVerifierPool([]crypto.PublicKey{maybeBrokenKey})
// after
if err := maybeBrokenKey.Validate(); err != nil {
    return fmt.Errorf("invalid ecdsa key: %w", err)
}
pool, err := jwt.NewVerifierPool([]crypto.PublicKey{maybeBrokenKey})

Defensive patterns

Strategy: validation

Validate before calling

if err := ecKey.Validate(); err != nil {
	return fmt.Errorf("invalid ECDSA key: %w", err)
}

Type guard

ek, ok := key.(*ecdsa.PublicKey); if !ok { /* not an EC key */ }

Try / catch

pool, err := jwt.NewVerifierPool(keys)
if err != nil {
	return fmt.Errorf("ES verifier setup: %w", err)
}

Prevention

Call ecdsa.PublicKey.Validate() before constructing verifiers.
Ensure x/y coordinates are decoded from the same curve as declared in the JWK.
Re-serialize keys from source data if deserialization errors are suspected.

When it happens

Trigger: newVerifierES failing for an ECDSA key whose curve was recognized (P-256/P-384/P-521) but whose parameters are inconsistent or rejected by the underlying ES verifier constructor.

Common situations: Corrupted or partially deserialized ECDSA keys; keys with mismatched curve/point data; library-internal constraint checks in the ES verifier failing for edge-case keys.

Related errors

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/379965a698f40388. Report an issue: GitHub.