alibaba/nacos · critical · RuntimeException

unsupported Algorithm:{}

Error message

unsupported Algorithm:{}

What it means

Thrown by CalculateV4SigningKeyUtil.finalSigningKey() as an unchecked RuntimeException when Mac.getInstance(signMethod) throws NoSuchAlgorithmException. This means the requested MAC algorithm is not available in the JVM's security providers. The default signMethod is HmacSHA256 (RamConstants.SIGNATURE_V4_METHOD), which is available on all standard JDKs, so this typically indicates a stripped-down or misconfigured JCE environment.

Source

Thrown at client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/CalculateV4SigningKeyUtil.java:76

        Mac mac = Mac.getInstance(signMethod);
        mac.init(new SecretKeySpec(firstSignkey, signMethod));
        return mac.doFinal(region.getBytes(StandardCharsets.UTF_8));
    }
    
    private static byte[] finalSigningKey(String secret, String date, String region,
        String productCode,
        String signMethod) {
        try {
            byte[] secondSignkey = regionSigningKey(secret, date, region, signMethod);
            Mac mac = Mac.getInstance(signMethod);
            mac.init(new SecretKeySpec(secondSignkey, signMethod));
            byte[] thirdSigningKey = mac.doFinal(productCode.getBytes(StandardCharsets.UTF_8));
            // 计算最终派生秘钥
            mac = Mac.getInstance(signMethod);
            mac.init(new SecretKeySpec(thirdSigningKey, signMethod));
            return mac.doFinal(CONSTANT.getBytes(StandardCharsets.UTF_8));
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("unsupported Algorithm:" + signMethod);
        } catch (InvalidKeyException e) {
            throw new RuntimeException("InvalidKey");
        }
    }
    
    /**
     * Return V4 signature key with base64 encode.
     *
     * @param secret      secret key
     * @param date        date  with utc format, like 20211222
     * @param region      region id
     * @param productCode cloud product code
     * @param signMethod  sign method
     * @return V4 signature key with base64 encode
     */
    public static String finalSigningKeyString(String secret, String date, String region,
        String productCode,
        String signMethod) {

View on GitHub (pinned to 9b989acdf1)

Solutions

  1. Verify the signMethod value from the exception message; the default and expected value is 'HmacSHA256'.
  2. Ensure the JVM has the standard SunJCE provider registered in java.security.
  3. If using a custom JRE image built with jlink, include the necessary crypto modules or use a full JDK.
  4. If running in FIPS mode, verify that HmacSHA256 is permitted by the FIPS provider configuration.

Example fix

// before — custom algorithm name not available
String key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, "HmacMD5");

// after — use the standard algorithm
String key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, "HmacSHA256");
Defensive patterns

Strategy: validation

Validate before calling

String signMethod = "HmacSHA256";
try {
    Mac.getInstance(signMethod);
} catch (NoSuchAlgorithmException e) {
    throw new IllegalStateException("Required MAC algorithm not available: " + signMethod
        + ". Check JCE provider configuration.", e);
}

Try / catch

try {
    key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, signMethod);
} catch (RuntimeException e) {
    if (e.getMessage().contains("unsupported Algorithm")) {
        throw new IllegalStateException("JCE provider misconfiguration: HmacSHA256 not available", e);
    }
    throw e;
}

Prevention

When it happens

Trigger: A custom or non-standard signMethod is passed to finalSigningKeyString() that is not registered with any JCE provider. Or the JVM has been configured with security providers that do not include the HMAC-SHA256 algorithm.

Common situations: Running on a minimal JRE or custom JDK distribution with removed crypto modules (jlink --no-header-files); BouncyCastle provider misconfiguration; FIPS-mode JVM that restricts available algorithms; passing a typo'd algorithm name.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/c82f3e743dbdbae2. Report an issue: GitHub.