{"record":{"id":"1c379c5980477594","repo":"hashicorp/nomad","slug":"specified-cipher-suites-don-t-support-the-certific","errorCode":null,"errorMessage":"Specified cipher suites don't support the certificate signature algorithm %s, consider adding more cipher suites to match this signature algorithm.","messagePattern":"Specified cipher suites don't support the certificate signature algorithm (.+?), consider adding more cipher suites to match this signature algorithm\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":427,"sourceCode":"\n\tif keyLoader.GetCertificate() != nil {\n\t\tsupportedSignatureAlgorithm, err := getSignatureAlgorithm(keyLoader.GetCertificate())\n\t\tif err != nil {\n\t\t\treturn []uint16{}, err\n\t\t}\n\n\t\tfor _, cipher := range parsedCiphers {\n\t\t\tif supportedCipherSignatures[cipher] == supportedSignatureAlgorithm {\n\t\t\t\t// Positive case, return the matched cipher suites as the signature\n\t\t\t\t// algorithm is also supported\n\t\t\t\treturn suites, nil\n\t\t\t}\n\t\t}\n\n\t\t// Negative case, if this is reached it means that none of the specified\n\t\t// cipher suites signature algorithms match the signature algorithm\n\t\t// for the certificate.\n\t\treturn []uint16{}, fmt.Errorf(\"Specified cipher suites don't support the certificate signature algorithm %s, consider adding more cipher suites to match this signature algorithm.\", supportedSignatureAlgorithm)\n\t}\n\n\t// Default in case this function is called but TLS is not actually configured\n\t// This is only reached if the TLS certificate is nil\n\treturn []uint16{}, nil\n}\n\n// getSignatureAlgorithm returns the signature algorithm for a TLS certificate\n// This is determined by examining the type of the certificate's public key,\n// as Golang doesn't expose a more straightforward  API which returns this\n// type\nfunc getSignatureAlgorithm(tlsCert *tls.Certificate) (signatureAlgorithm, error) {\n\tprivKey := tlsCert.PrivateKey\n\tswitch privKey.(type) {\n\tcase *rsa.PrivateKey:\n\t\treturn rsaStringRepr, nil\n\tcase *ecdsa.PrivateKey:\n\t\treturn ecdsaStringRepr, nil","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L409-L445","documentation":"After parsing the cipher list, ParseCiphers cross-checks each cipher's signature algorithm (RSA vs ECDSA) against the signature algorithm of the configured certificate. If no specified cipher supports the certificate's signature algorithm, the TLS handshake could never succeed, so the function errors out with this guidance message.","triggerScenarios":"Calling ParseCiphers with a certificate whose key is ECDSA (or RSA) while every cipher in TLSCipherSuites is for the other key type, e.g. an ECDSA cert paired only with TLS_ECDHE_RSA_* ciphers.","commonSituations":"Switching certificates from RSA to ECDSA (or vice versa) without updating tls_cipher_suites; restricting the cipher list too aggressively for hardening; automated TLS rotation changing the key type.","solutions":["Add cipher suites matching the certificate's signature algorithm (e.g. add TLS_ECDHE_ECDSA_* ciphers for an ECDSA cert).","Or issue a certificate whose key type matches the configured cipher suites.","Remove the restrictive tls_cipher_suites setting to use the defaults, which cover both algorithms."],"exampleFix":"// before\ntls_cipher_suites = \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\" // cert is ECDSA\n// after\ntls_cipher_suites = \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\"","handlingStrategy":"validation","validationCode":"// ensure ciphers cover the cert's key type\nisECDSA := cert.SignatureAlgorithm == x509.ECDSAWithSHA256 || cert.SignatureAlgorithm == x509.ECDSAWithSHA384\nneedPrefix := \"TLS_ECDHE_RSA_\"\nif isECDSA { needPrefix = \"TLS_ECDHE_ECDSA_\" }\nif !strings.Contains(tlsCipherSuites, needPrefix) {\n    return fmt.Errorf(\"add %s* ciphers to match cert signature algorithm\", needPrefix)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair cipher lists with certificate key types explicitly.","When rotating certs, re-check tls_cipher_suites compatibility.","Prefer omitting tls_cipher_suites to use safe defaults covering both algorithms."],"tags":["tls","ciphersuite","certificate"],"backgroundTag":"tls-cipher-signature-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}