{"record":{"id":"0233e24156f8532b","repo":"quarkusio/quarkus","slug":"failed-to-generate-ec-p-256-signing-key","errorCode":null,"errorMessage":"Failed to generate EC P-256 signing key","messagePattern":"Failed to generate EC P-256 signing key","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/deployment/src/main/java/io/quarkus/spiffe/client/deployment/SpiffeDevServicesProcessor.java","lineNumber":344,"sourceCode":"            if (endpointSocket != null && endpointSocket.startsWith(UNIX)) {\n                String path = endpointSocket.substring(UNIX.length());\n                try {\n                    Files.deleteIfExists(Path.of(path));\n                } catch (IOException e) {\n                    LOG.debug(\"Failed to clean up socket file\", e);\n                }\n            }\n        }\n\n        @Override\n        public void start() {\n            try {\n                signingKey = EcJwkGenerator.generateJwk(EllipticCurves.P256);\n                signingKey.setKeyId(\"quarkus-spiffe-dev-svc\");\n                signingKey.setUse(\"jwt-svid\");\n            } catch (Exception e) {\n                errorMessages.add(\"Failed to generate EC P-256 signing key: \" + e.getMessage());\n                throw new RuntimeException(\"Failed to generate EC P-256 signing key\", e);\n            }\n            // trying to keep resources minimal:\n            vertx = Vertx.vertx(new VertxOptions().setWorkerPoolSize(1).setEventLoopPoolSize(1));\n\n            startGrpcServer();\n            startHttpServer();\n        }\n\n        private void startGrpcServer() {\n            if (transport == Transport.UNIX) {\n                Path socketPath;\n                try {\n                    socketPath = Files.createTempFile(Path.of(\"/tmp\"), \"spiffe-\", \".sock\");\n                    Files.delete(socketPath);\n                } catch (IOException e) {\n                    errorMessages.add(\"Failed to create temp socket path: \" + e.getMessage());\n                    throw new RuntimeException(\"Failed to create temp socket path\", e);\n                }","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/deployment/src/main/java/io/quarkus/spiffe/client/deployment/SpiffeDevServicesProcessor.java#L326-L362","documentation":"The SPIFFE dev service generates an EC P-256 JWK (via smallrye-jwt's EcJwkGenerator) to sign JWT-SVIDs it issues in local dev. If key generation throws for any reason, the dev server start aborts with RuntimeException 'Failed to generate EC P-256 signing key', wrapping the original exception; the cause message is also collected into errorMessages.","triggerScenarios":"start() calls EcJwkGenerator.generateJwk(EllipticCurves.P256) and any underlying exception occurs — typically missing crypto provider classes, a broken/incompatible BouncyCastle or jose4j/smallrye-jwt version on the deployment classpath, or JVM crypto restrictions.","commonSituations":"Dependency conflicts where an older jose4j or missing EC provider shadows the expected one; running on a hardened/FIPS JVM lacking P-256 EC support; classloader issues in the Quarkus deployment phase after an extension version bump.","solutions":["Read the wrapped cause (`Caused by:`) in the stack trace — the real failure (NoSuchProviderException, NoSuchAlgorithmException, NoClassDefFoundError) tells you which dependency to fix.","Align io.smallrye.jwt / jose4j versions with the Quarkus BOM (do not pin them manually).","If on a restricted JVM, enable the required JCE provider or use a standard JDK that supports EC P-256."],"exampleFix":"// before: pinned old jwt libs overriding the BOM\n<dependency>\n  <groupId>org.bitbucket.b_c</groupId>\n  <artifactId>jose4j</artifactId>\n  <version>0.7.9</version>\n</dependency>\n\n// after: let the Quarkus BOM manage the version\n<dependency>\n  <groupId>org.bitbucket.b_c</groupId>\n  <artifactId>jose4j</artifactId>\n</dependency>","handlingStrategy":"try-catch","validationCode":"// Ensure the JWT/EC provider is on the classpath before dev services start:\n// ./mvnw dependency:tree -Dincludes=org.bitbucket.b_c:jose4j","typeGuard":null,"tryCatchPattern":"try {\n    signingKey = EcJwkGenerator.generateJwk(EllipticCurves.P256);\n} catch (Exception e) {\n    LOG.error(\"EC P-256 keygen failed; check jose4j/smallrye-jwt versions and JVM crypto policy\", e);\n    throw e;\n}","preventionTips":["Let the Quarkus BOM manage jose4j/smallrye-jwt versions","Avoid FIPS-restricted JVMs for dev mode, or install the required JCE provider","Read the wrapped cause — it names the actual failing crypto primitive"],"tags":["quarkus","spiffe","dev-services","crypto","key-generation"],"backgroundTag":"key-generation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}