{"record":{"id":"3ee710d6b7395c7f","repo":"hashicorp/nomad","slug":"could-not-encrypt-w","errorCode":null,"errorMessage":"could not encrypt: %w","messagePattern":"could not encrypt: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":282,"sourceCode":"\t}\n\treturn nil\n}\n\n// Encrypt encrypts the clear data with the cipher for the active root key, and\n// returns the cipher text (including the nonce), and the key ID used to encrypt\n// it\nfunc (e *Encrypter) Encrypt(cleartext []byte) ([]byte, string, error) {\n\tcs, err := e.activeCipherSet()\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\n\tkeyID := cs.rootKey.Meta.KeyID\n\tadditional := kms.WithAad([]byte(keyID)) // include the keyID in the seal inputs\n\n\tbi, err := cs.wrapper.Encrypt(e.srv.shutdownCtx, cleartext, additional)\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"could not encrypt: %w\", err)\n\t}\n\treturn bi.Ciphertext, keyID, nil\n}\n\n// Decrypt takes an encrypted buffer and then root key ID. It extracts\n// the nonce, decrypts the content, and returns the cleartext data.\nfunc (e *Encrypter) Decrypt(ciphertext []byte, keyID string) ([]byte, error) {\n\tctx, cancel := context.WithTimeout(e.srv.shutdownCtx, time.Second)\n\tdefer cancel()\n\tks, err := e.waitForKey(ctx, keyID)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tadditional := kms.WithAad([]byte(keyID)) // keyID was included in the seal inputs\n\tbi := &kms.BlobInfo{\n\t\tCiphertext: ciphertext, // nonce was stored alongside ciphertext\n\t}","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L264-L300","documentation":"The KMS wrapper's Encrypt call failed while encrypting data with the cipher set's root key. The underlying wrapper error (context canceled, KMS backend unavailable, invalid key state) is wrapped with 'could not encrypt'.","triggerScenarios":"Encrypter.Encrypt -> encrypt -> cs.wrapper.Encrypt(shutdownCtx, cleartext, aad) returns an error; with the AEAD provider this means local cipher setup failed, with transit/cloud KMS providers it means the remote call failed. Also surfaces if the server is shutting down (shutdownCtx canceled).","commonSituations":"Vault transit token expired, AWS/GCP/Azure KMS network or IAM error, server shutdown in progress, or internal AEAD failure after a keyring reload raced an encryption request.","solutions":["Inspect the wrapped cause to identify the failing provider (local AEAD vs Vault transit vs cloud KMS)","For remote KMS providers, verify credentials, network reachability, and IAM/key permissions","Retry the operation if the server was mid-restart or the key was rotating","If shutdownCtx was canceled, re-issue the request after the server is healthy"],"exampleFix":"// before: expired Vault token breaks transit encryption\n//   vault token renew or fix vault config token\n// after: ensure the agent's Vault config uses a renewable token / approle\n//   vault {\n//     address = \"https://vault:8200\"\n//     role    = \"nomad-server\"\n//   }","handlingStrategy":"try-catch","validationCode":"// pre-check Vault transit reachability before encrypting\nresp, err := http.Get(\"https://vault:8200/v1/sys/health\")\nif err != nil || resp.StatusCode >= 500 {\n  return fmt.Errorf(\"vault unreachable, encryption will fail\")\n}","typeGuard":null,"tryCatchPattern":"blob, keyID, err := encrypter.Encrypt(ctx, plaintext)\nif err != nil {\n  var ctxErr error\n  if errors.Is(err, context.Canceled) || srvShutdownInProgress {\n    ctxErr = fmt.Errorf(\"server shutting down, requeue work: %w\", err)\n  } else if isTransientKMS(err) {\n    ctxErr = fmt.Errorf(\"transient KMS error, retry with backoff: %w\", err)\n  }\n  return nil, ctxErr\n}","preventionTips":["Renew Vault tokens automatically (AppRole / token renewal) for transit provider","Grant cloud KMS IAM permissions broadly enough for encrypt/decrypt on the key","Monitor server shutdown windows and pause workloads during maintenance","Add health checks against the KMS backend in deployment pipelines"],"tags":["encryption","kms","aead","go"],"backgroundTag":"encryption-operation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}