alibaba/nacos · error · RuntimeException

signWithhmacSHA1Encrypt fail

Error message

signWithhmacSHA1Encrypt fail

What it means

Thrown by SpasAdapter.signWithHmacSha1Encrypt() as an unchecked RuntimeException wrapping any Exception that occurs during HMAC-SHA1 signing. The try block covers getBytes() (UnsupportedEncodingException), Mac.getInstance() (NoSuchAlgorithmException), mac.init() (InvalidKeyException), and Base64 encoding. This is used to generate the Spas-Signature header for Nacos config/dataId-level access control.

Source

Thrown at client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/SpasAdapter.java:130

     * @param encryptText encrypt text
     * @param encryptKey  encrypt key
     * @return base64 string
     */
    public static String signWithHmacSha1Encrypt(String encryptText, String encryptKey) {
        try {
            byte[] data = encryptKey.getBytes(Constants.ENCODE);
            // Construct a key according to the given byte array, and the second parameter specifies the name of a key algorithm
            SecretKey secretKey = new SecretKeySpec(data, SHA_ENCRYPT);
            // Generate a Mac object specifying Mac algorithm
            Mac mac = Mac.getInstance(SHA_ENCRYPT);
            // Initialize the Mac object with the given key
            mac.init(secretKey);
            byte[] text = encryptText.getBytes(Constants.ENCODE);
            byte[] textFinal = mac.doFinal(text);
            // Complete Mac operation, base64 encoding, convert byte array to string
            return new String(Base64.encodeBase64(textFinal), Constants.ENCODE);
        } catch (Exception e) {
            throw new RuntimeException("signWithhmacSHA1Encrypt fail", e);
        }
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure the secret key is set and non-null before calling SpasAdapter.getSignHeaders() or any signing operation.
2. Verify the JVM supports HmacSHA1 (standard on all JDKs; check FIPS/custom JCE configs).
3. Check the original exception cause in the RuntimeException for the specific failure.
4. If using CredentialService, ensure it is initialized with valid credentials before signing.

Example fix

// before — calling getSignHeaders with null secretKey
Map<String, String> headers = SpasAdapter.getSignHeaders(resource, null);

// after
String sk = CredentialService.getInstance().getCredential().getSecretKey();
if (sk == null || sk.isEmpty()) {
    throw new IllegalStateException("Secret key not configured");
}
Map<String, String> headers = SpasAdapter.getSignHeaders(resource, sk);

String secretKey = SpasAdapter.getSk();
if (secretKey == null || secretKey.isEmpty()) {
    throw new IllegalStateException("Cannot sign: secret key is null or empty.");
}
// safe to call getSignHeaders now

try {
    headers = SpasAdapter.getSignHeaders(resource, secretKey);
} catch (RuntimeException e) {
    if (e.getMessage().contains("signWithhmacSHA1Encrypt fail")) {
        // Inspect cause for NoSuchAlgorithmException or InvalidKeyException
        throw new IllegalStateException("HMAC-SHA1 signing failed", e.getCause());
    }
    throw e;
}

When it happens

Trigger: encryptKey (the secret key) is null or invalid for HmacSHA1; encryptText or encryptKey contains characters that cannot be encoded in Constants.ENCODE (UTF-8); the JVM lacks the HmacSHA1 algorithm.

Common situations: CredentialService returns a null secretKey; the JVM is a stripped-down distribution without HmacSHA1; encoding issues in non-UTF-8 environments; credential not set before calling getSignHeaders().

Related errors

• unsupported Algorithm:{}
• InvalidKey
• 500
• Invalid Agent Version contentDigest
• Request parameter `agentSpecCard` should not be null or empt

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/7570ea1addb07223. Report an issue: GitHub.