apache/rocketmq · error · AclException

10015

10015

Error message

[10015:signature-failed] unable to calculate a request signature. error=%s

What it means

Thrown by AclSigner.signAndBase64Encode when the client cannot compute the HMAC request signature required by RocketMQ ACL. The String-based calSignature path encodes data/key with the given charset, runs Mac over them, and Base64-encodes the result; any exception in that pipeline is wrapped as AclException code 10015 (CAL_SIGNATURE_FAILED). It always wraps an underlying cause (e.g. UnsupportedCharsetException, InvalidKeyException).

Source

Thrown at client/src/main/java/org/apache/rocketmq/acl/common/AclSigner.java:53

    public static String calSignature(String data, String key) throws AclException {
        return calSignature(data, key, DEFAULT_ALGORITHM, DEFAULT_CHARSET);
    }

    public static String calSignature(String data, String key, SigningAlgorithm algorithm,
        Charset charset) throws AclException {
        return signAndBase64Encode(data, key, algorithm, charset);
    }

    private static String signAndBase64Encode(String data, String key, SigningAlgorithm algorithm, Charset charset)
        throws AclException {
        try {
            byte[] signature = sign(data.getBytes(charset), key.getBytes(charset), algorithm);
            return new String(Base64.encodeBase64(signature), DEFAULT_CHARSET);
        } catch (Exception e) {
            String message = String.format(CAL_SIGNATURE_FAILED_MSG, CAL_SIGNATURE_FAILED, e.getMessage());
            log.error(message, e);
            throw new AclException("CAL_SIGNATURE_FAILED", CAL_SIGNATURE_FAILED, message, e);
        }
    }

    private static byte[] sign(byte[] data, byte[] key, SigningAlgorithm algorithm) throws AclException {
        try {
            Mac mac = Mac.getInstance(algorithm.toString());
            mac.init(new SecretKeySpec(key, algorithm.toString()));
            return mac.doFinal(data);
        } catch (Exception e) {
            String message = String.format(CAL_SIGNATURE_FAILED_MSG, CAL_SIGNATURE_FAILED, e.getMessage());
            log.error(message, e);
            throw new AclException("CAL_SIGNATURE_FAILED", CAL_SIGNATURE_FAILED, message, e);
        }
    }

    public static String calSignature(byte[] data, String key) throws AclException {
        return calSignature(data, key, DEFAULT_ALGORITHM, DEFAULT_CHARSET);
    }

View on GitHub (pinned to 293f588571)

Solutions

1. Check the wrapped cause in the log line (log.error prints the full stack) to see whether it is InvalidKeyException, NoSuchAlgorithmException, or a charset problem.
2. Verify the AccessSecret in the ACL config file is non-empty and correctly copied (no whitespace/newline) on both client and broker.
3. Use a standard algorithm (HmacSHA1 is the default; HmacSHA256 is safe on stock JDKs) and a standard charset (UTF-8).
4. On restricted/FIPS JVMs, add a JCA provider that supports the algorithm or switch the algorithm to one the provider allows.

Example fix

// before
String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA384, Charset.forName("UTF-16"));

// after
String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA256, StandardCharsets.UTF_8);

import javax.crypto.Mac;
import java.nio.charset.StandardCharsets;

static boolean signatureConfigOk(String secretKey, String algorithm) {
    if (secretKey == null || secretKey.isEmpty()) return false;
    try {
        Mac.getInstance(algorithm);
        return true;
    } catch (Exception e) {
        return false;
    }
}

try {
    String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA1, StandardCharsets.UTF_8);
} catch (AclException e) {
    // code 10015: inspect e.getCause() for InvalidKey/NoSuchAlgorithm/charset detail
    throw new IllegalStateException("ACL signature misconfigured: " + e.getMessage(), e);
}

When it happens

Trigger: Calling AclSigner.calSignature(data, key, algorithm, charset) or any ACL-enabled client operation (send/consume with aclEnable=true) with an unsupported charset name, a null/empty secret key that makes SecretKeySpec invalid, or a JCA provider missing the requested Mac algorithm.

Common situations: Misconfigured plain_acl.yml with an empty AccessSecret; JDK without the requested algorithm (e.g. HmacSHA384/512 on restricted JVMs); passing a custom SigningAlgorithm string that is not a valid Mac name; FIPS JVMs that disable HmacSHA1.

Related errors

• check signature failed.
• The user is not exist
• datetime is null.
• authentication header is incorrect.
• authentication keyValues length is incorrect, actual length=

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/b6f59fa077b9dd9d. Report an issue: GitHub.