apache/rocketmq · error · AclException

10015

10015

Error message

[10015:signature-failed] unable to calculate a request signature. error=%s

What it means

Thrown by AclSigner.signAndBase64Encode when the client cannot compute the HMAC request signature required by RocketMQ ACL. The String-based calSignature path encodes data/key with the given charset, runs Mac over them, and Base64-encodes the result; any exception in that pipeline is wrapped as AclException code 10015 (CAL_SIGNATURE_FAILED). It always wraps an underlying cause (e.g. UnsupportedCharsetException, InvalidKeyException).

Solutions

1. Check the wrapped cause in the log line (log.error prints the full stack) to see whether it is InvalidKeyException, NoSuchAlgorithmException, or a charset problem.
2. Verify the AccessSecret in the ACL config file is non-empty and correctly copied (no whitespace/newline) on both client and broker.
3. Use a standard algorithm (HmacSHA1 is the default; HmacSHA256 is safe on stock JDKs) and a standard charset (UTF-8).
4. On restricted/FIPS JVMs, add a JCA provider that supports the algorithm or switch the algorithm to one the provider allows.

Example fix

// before
String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA384, Charset.forName("UTF-16"));

// after
String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA256, StandardCharsets.UTF_8);

import javax.crypto.Mac;
import java.nio.charset.StandardCharsets;

static boolean signatureConfigOk(String secretKey, String algorithm) {
    if (secretKey == null || secretKey.isEmpty()) return false;
    try {
        Mac.getInstance(algorithm);
        return true;
    } catch (Exception e) {
        return false;
    }
}

try {
    String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA1, StandardCharsets.UTF_8);
} catch (AclException e) {
    // code 10015: inspect e.getCause() for InvalidKey/NoSuchAlgorithm/charset detail
    throw new IllegalStateException("ACL signature misconfigured: " + e.getMessage(), e);
}

When it happens

Trigger: Calling AclSigner.calSignature(data, key, algorithm, charset) or any ACL-enabled client operation (send/consume with aclEnable=true) with an unsupported charset name, a null/empty secret key that makes SecretKeySpec invalid, or a JCA provider missing the requested Mac algorithm.

Common situations: Misconfigured plain_acl.yml with an empty AccessSecret; JDK without the requested algorithm (e.g. HmacSHA384/512 on restricted JVMs); passing a custom SigningAlgorithm string that is not a valid Mac name; FIPS JVMs that disable HmacSHA1.

Related errors

• check signature failed.
• The user is not exist
• authentication credential length is incorrect, actual…
• authentication header is incorrect.
• authentication keyValues length is incorrect, actual length=

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/b6f59fa077b9dd9d. Report an issue: GitHub.

Appendix: source

Thrown at client/src/main/java/org/apache/rocketmq/acl/common/AclSigner.java:53

    public static String calSignature(String data, String key) throws AclException {
        return calSignature(data, key, DEFAULT_ALGORITHM, DEFAULT_CHARSET);
    }

    public static String calSignature(String data, String key, SigningAlgorithm algorithm,
        Charset charset) throws AclException {
        return signAndBase64Encode(data, key, algorithm, charset);
    }

    private static String signAndBase64Encode(String data, String key, SigningAlgorithm algorithm, Charset charset)
        throws AclException {
        try {
            byte[] signature = sign(data.getBytes(charset), key.getBytes(charset), algorithm);
            return new String(Base64.encodeBase64(signature), DEFAULT_CHARSET);
        } catch (Exception e) {
            String message = String.format(CAL_SIGNATURE_FAILED_MSG, CAL_SIGNATURE_FAILED, e.getMessage());
            log.error(message, e);
            throw new AclException("CAL_SIGNATURE_FAILED", CAL_SIGNATURE_FAILED, message, e);
        }
    }

    private static byte[] sign(byte[] data, byte[] key, SigningAlgorithm algorithm) throws AclException {
        try {
            Mac mac = Mac.getInstance(algorithm.toString());
            mac.init(new SecretKeySpec(key, algorithm.toString()));
            return mac.doFinal(data);
        } catch (Exception e) {
            String message = String.format(CAL_SIGNATURE_FAILED_MSG, CAL_SIGNATURE_FAILED, e.getMessage());
            log.error(message, e);
            throw new AclException("CAL_SIGNATURE_FAILED", CAL_SIGNATURE_FAILED, message, e);
        }
    }

    public static String calSignature(byte[] data, String key) throws AclException {
        return calSignature(data, key, DEFAULT_ALGORITHM, DEFAULT_CHARSET);
    }

View on GitHub (pinned to 293f588571)