What causes "empty rsa public key" in XTLS/Xray-core?

Export the server's public key as DER/PKIX bytes and set rsa_public_key on the client config.

empty rsa public key

Error message

empty rsa public key

What it means

Thrown by newClientConn in the XMC (Minecraft-protocol) transport when the client config's rsa_public_key bytes are empty. The client needs the server's RSA public key both to pin it during the handshake (it must equal the key in the Encryption Request) and to encrypt the shared secret and verify token.

Source

Thrown at transport/internet/finalmask/xmc/client.go:46

	profiles        []loginProfile
	password        string
	rsaPublicKey    []byte
	hostname        string
	paddingSchedule []paddingTurn
	packet          *packetStream
	deadlines       *connectionDeadlines
}

type clientState int

var (
	clientStateHandshake clientState = 1
	clientStateProxy     clientState = 2
)

func newClientConn(c net.Conn, profiles []loginProfile, password string, rsaPublicKey []byte, hostname string) (*clientConn, error) {
	if len(rsaPublicKey) == 0 {
		return nil, fmt.Errorf("empty rsa public key")
	}
	if len(profiles) == 0 {
		return nil, fmt.Errorf("empty profiles")
	}
	paddingSchedule, err := newClientPaddingSchedule2612()
	if err != nil {
		return nil, fmt.Errorf("select padding profile: %w", err)
	}
	return &clientConn{
		reader:          bufio.NewReader(c),
		writer:          c,
		c:               c,
		state:           clientStateHandshake,
		handshakeLock:   sync.Mutex{},
		profiles:        profiles,
		password:        password,
		rsaPublicKey:    rsaPublicKey,
		hostname:        hostname,

View on GitHub (pinned to 7d214f8b09)

Solutions

Export the server's public key as DER/PKIX bytes and set rsa_public_key on the client config.
Confirm you copied the public (not private) key and that base64 decoding produced non-empty bytes.
Verify the server side actually has a key pair configured so both sides agree.

Example fix

// before
"rsaPublicKey": ""
// after
"rsaPublicKey": "MIIBIjANBgkq..."

Defensive patterns

Strategy: validation

Validate before calling

if len(cfg.RsaPublicKey) == 0 {
	return errors.New("xmc client requires rsa_public_key (server's PKIX DER public key)")
}

Prevention

Fail fast in your config loader when rsa_public_key is missing.
Store the key as raw PKIX DER bytes (or decode base64 before passing) exactly as the server emits it.

When it happens

Trigger: Creating an XMC client connection with Config.RsaPublicKey nil or empty (config.pb.go field rsa_public_key). The check is the first thing newClientConn does, so the connection fails before any I/O.

Common situations: Omitting rsa_public_key from the outbound config; copying the server config block to the client side and dropping the key; generating the server key pair but pasting only the private key into the client config.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/607bdeeb9204babd. Report an issue: GitHub.