{"record":{"id":"413b905a6046c3f9","repo":"hashicorp/nomad","slug":"invalid-key-type-t","errorCode":null,"errorMessage":"invalid key type: %T","messagePattern":"invalid key type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":267,"sourceCode":"\t\treturn \"\", \"\", err\n\t}\n\n\tvar buf bytes.Buffer\n\terr = pem.Encode(&buf, &pem.Block{Type: \"CERTIFICATE\", Bytes: bs})\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"error encoding private key: %s\", err)\n\t}\n\n\treturn buf.String(), pk, nil\n}\n\n// KeyId returns a x509 KeyId from the given signing key.\nfunc keyID(raw interface{}) ([]byte, error) {\n\tswitch raw.(type) {\n\tcase *ecdsa.PublicKey:\n\tcase *rsa.PublicKey:\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"invalid key type: %T\", raw)\n\t}\n\n\t// This is not standard; RFC allows any unique identifier as long as they\n\t// match in subject/authority chains but suggests specific hashing of DER\n\t// bytes of public key including DER tags.\n\tbs, err := x509.MarshalPKIXPublicKey(raw)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// String formatted\n\tkID := sha256.Sum256(bs)\n\treturn kID[:], nil\n}\n\n// ParseCert parses the x509 certificate from a PEM-encoded value.\nfunc ParseCert(pemValue string) (*x509.Certificate, error) {\n\t// The _ result below is not an error but the remaining PEM bytes.","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L249-L285","documentation":"keyID was given a public key whose concrete Go type is neither *ecdsa.PublicKey nor *rsa.PublicKey, so the switch falls through to the default and refuses to compute an RFC 5280 Subject Key Identifier. This is a programming error in the caller, not a data-corruption issue.","triggerScenarios":"Calling keyID (directly, or indirectly via GenerateCA/GenerateCert with a custom signer) with an Ed25519 public key, ed25519.PrivateKey passed instead of its Public(), or any other crypto.Signer implementation.","commonSituations":"Forking or extending the CA code to use Ed25519 or a PKCS#11/HSM-backed signer; accidentally passing a private key rather than signer.Public(); refactoring so the wrong variable is handed to keyID.","solutions":["Pass the public key (e.g. signer.Public()) rather than the private key to keyID.","Use an ECDSA (P-256) or RSA private key when generating CAs/certs with this helper.","If you need Ed25519, extend keyID's switch to handle *ed25519.PublicKey.","Verify any custom crypto.Signer implementation's Public() returns *ecdsa.PublicKey or *rsa.PublicKey."],"exampleFix":"// before\nsigner := ed25519.GenerateKey(rand.Reader)\nkid, err := keyID(signer)\n// after\necdsaKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\nkid, err := keyID(&ecdsaKey.PublicKey)","handlingStrategy":"type-guard","validationCode":"func isSupportedSigner(s crypto.Signer) error {\n\tswitch s.Public().(type) {\n\tcase *ecdsa.PublicKey, *rsa.PublicKey:\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported key type %T; use ECDSA or RSA\", s.Public())\n\t}\n}","typeGuard":"func isSupportedPublicKey(pub interface{}) bool {\n\tswitch pub.(type) {\n\tcase *ecdsa.PublicKey, *rsa.PublicKey:\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":"if !isSupportedPublicKey(signer.Public()) {\n\treturn fmt.Errorf(\"cannot compute key ID for %T\", signer.Public())\n}\nkid, err := keyID(signer.Public())\nif err != nil { return err }","preventionTips":["Always pass signer.Public(), never the private key, to key ID computation.","Standardize on ECDSA P-256 or RSA keys for CA/cert generation in this helper.","Add a switch case for new key types when migrating (e.g. Ed25519 requires code changes here)."],"tags":["tls","x509","key-type"],"backgroundTag":"unsupported-key-type","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}