{"record":{"id":"0e4899bec16229ce","repo":"lcobucci/jwt","slug":"there-was-an-error-while-creating-the-signature-opensslerror","errorCode":null,"errorMessage":"There was an error while creating the signature:{opensslError}","messagePattern":"There was an error while creating the signature:(.+?)","errorType":"exception","errorClass":"Lcobucci\\JWT\\Signer\\CannotSignPayload","httpStatus":null,"severity":"error","filePath":"src/Signer/OpenSSL.php","lineNumber":52,"sourceCode":"        OPENSSL_KEYTYPE_EC => 'EC',\n    ];\n\n    /**\n     * @return non-empty-string\n     *\n     * @throws CannotSignPayload\n     * @throws InvalidKeyProvided\n     */\n    final protected function createSignature(\n        Key $key,\n        string $payload,\n    ): string {\n        $opensslKey = $this->getPrivateKey($key);\n\n        $signature = '';\n\n        if (! openssl_sign($payload, $signature, $opensslKey, $this->algorithm())) {\n            throw CannotSignPayload::errorHappened($this->fullOpenSSLErrorString());\n        }\n\n        return $signature;\n    }\n\n    /** @throws CannotSignPayload */\n    private function getPrivateKey(\n        Key $key,\n    ): OpenSSLAsymmetricKey {\n        return $this->validateKey(openssl_pkey_get_private($key->contents(), $key->passphrase()));\n    }\n\n    /** @throws InvalidKeyProvided */\n    final protected function verifySignature(\n        string $expected,\n        string $payload,\n        Key $key,\n    ): bool {","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Signer/OpenSSL.php#L34-L70","documentation":"Thrown by OpenSSL::createSignature when openssl_sign() returns false, meaning PHP's OpenSSL extension could not produce a signature. The message includes the accumulated OpenSSL error string, which usually explains why (key problems, algorithm mismatch, malformed key).","triggerScenarios":"Calling sign() with a private key that OpenSSL cannot load or use: invalid PEM contents, encrypted key without passphrase, wrong key type for the configured algorithm, or an uninitialized OpenSSLAsymmetricKey.","commonSituations":"Key file contains a public key where a private key is required, corrupted or truncated PEM, passphrase-protected key passed without the passphrase, LibreSSL/OpenSSL version differences on stripped containers (e.g. alpine).","solutions":["Run `openssl pkey -in key.pem -check` to confirm the private key is valid","Make sure you pass the private key (not the public key) for signing","Supply the passphrase if the key is encrypted (InMemory file contents / explicit passphrase)","Check OpenSSL error details in the message and container OpenSSL version compatibility"],"exampleFix":"// before\n$key = InMemory::file('/path/public.pem'); // public key cannot sign\n// after\n$key = InMemory::file('/path/private.pem');","handlingStrategy":"try-catch","validationCode":"$res = openssl_pkey_get_private(file_get_contents($pem), $passphrase); if ($res === false) { throw new RuntimeException('Invalid private key: ' . openssl_error_string()); }","typeGuard":null,"tryCatchPattern":"try { $token = $builder->signedWith($key)->getToken(...); } catch (\\Jose\\Component\\Signature\\Exception\\CannotSignPayload $e) { /* inspect OpenSSL error in message */ }","preventionTips":["Pre-check keys with `openssl pkey -check` in deployment scripts","Distinguish private vs public key files by naming convention","Record OpenSSL version in your environment; watch for LibreSSL quirks"],"tags":["openssl","rsa","signature","key"],"backgroundTag":"invalid-config-value","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}