{"record":{"id":"4d82c9f2beb837c4","repo":"hashicorp/nomad","slug":"failed-to-generate-rsa-key-w","errorCode":null,"errorMessage":"failed to generate rsa key: %w","messagePattern":"failed to generate rsa key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"nomad/structs/keyring.go","lineNumber":75,"sourceCode":"\tmeta.Algorithm = algorithm\n\n\trootKey := &UnwrappedRootKey{\n\t\tMeta: meta,\n\t}\n\n\tswitch algorithm {\n\tcase EncryptionAlgorithmAES256GCM:\n\t\tkey, err := crypto.Bytes(32)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to generate root key: %w\", err)\n\t\t}\n\t\trootKey.Key = key\n\t}\n\n\t// Generate RSA key for signing workload identity JWTs with RS256.\n\trsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate rsa key: %w\", err)\n\t}\n\n\trootKey.RSAKey = x509.MarshalPKCS1PrivateKey(rsaPrivateKey)\n\n\treturn rootKey, nil\n}\n\nfunc (k *UnwrappedRootKey) Copy() *UnwrappedRootKey {\n\treturn &UnwrappedRootKey{\n\t\tMeta:   k.Meta.Copy(),\n\t\tKey:    slices.Clone(k.Key),\n\t\tRSAKey: slices.Clone(k.RSAKey),\n\t}\n}\n\n// MakeActive returns a copy of the RootKey with the meta state set to active\nfunc (k *UnwrappedRootKey) MakeActive() *UnwrappedRootKey {\n\tmeta := k.Meta.Copy()","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/keyring.go#L57-L93","documentation":"Generating the 2048-bit RSA key used to sign workload identity JWTs failed; the wrapped crypto error from rsa.GenerateKey typically indicates an entropy or system-level failure.","triggerScenarios":"Calling NewUnwrappedRootKey when rsa.GenerateKey(rand.Reader, 2048) returns an error, almost always due to rand.Reader (crypto/rand) failing to supply entropy.","commonSituations":"Same entropy problems as AES key generation: blocked getrandom syscall, sandboxed CI, kernel entropy issues; very rare since RSA generation only needs the same rand.Reader.","solutions":["Retry key generation","Ensure the system entropy source (/dev/urandom) is available and healthy","Check for OS-level crypto library issues in logs"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// probe crypto/rand before keyring operations\nif _, err := crand.Read(make([]byte, 16)); err != nil {\n  return fmt.Errorf(\"crypto/rand broken in this environment: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"rootKey, err := structs.NewUnwrappedRootKey(alg)\nif err != nil && strings.Contains(err.Error(), \"failed to generate rsa key\") {\n  // fix rand.Reader / entropy source, then retry\n}","preventionTips":["Verify crypto/rand works in restricted CI images","Do not disable getrandom in sandbox policies","Surface wrapped errors (%w) with errors.As for diagnosis"],"tags":["nomad","keyring","rsa","crypto","entropy"],"backgroundTag":"random-generation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}