{"record":{"id":"4e5ef1d57ae2cc1a","repo":"hashicorp/nomad","slug":"w-rsa-key-w","errorCode":null,"errorMessage":"%w (rsa key): %w","messagePattern":"%w \\(rsa key\\): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":596,"sourceCode":"\t\t\te.log.Error(err.Error(), \"key_id\", meta.KeyID)\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = helper.WithBackoffFunc(ctx, minBackoff, maxBackoff, func() error {\n\t\tvar err error\n\n\t\t// Decrypt RSAKey for Workload Identity JWT signing if one exists. Prior to\n\t\t// 1.7 an ed25519 key derived from the root key was used instead of an RSA\n\t\t// key.\n\t\tif wrappedKey.WrappedRSAKey != nil && len(wrappedKey.WrappedRSAKey.Ciphertext) > 0 {\n\t\t\trsaKey, err = wrapper.Decrypt(e.srv.shutdownCtx, wrappedKey.WrappedRSAKey)\n\t\t\tif err != nil {\n\t\t\t\terr := fmt.Errorf(\"%w (rsa key): %w\", ErrDecryptFailed, err)\n\t\t\t\te.log.Error(err.Error(), \"key_id\", meta.KeyID)\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\trootKey := &structs.UnwrappedRootKey{\n\t\tMeta:   meta,\n\t\tKey:    key,\n\t\tRSAKey: rsaKey,\n\t}\n\n\tvar generatedCipher *cipherSet\n\n\terr = helper.WithBackoffFunc(ctx, minBackoff, maxBackoff, func() error {","sourceCodeStart":578,"sourceCodeEnd":614,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L578-L614","documentation":"While restoring the keyring, decryption of the wrapped RSA key (used for Workload Identity JWT signing since 1.7) failed. Unlike the DEK failure (2200), this is only logged, not returned — the cipherSet is created without an RSA private key, so JWT signing via RSA will be unavailable while ed25519 fallback may still work.","triggerScenarios":"wrappedKey.WrappedRSAKey is non-empty but wrapper.Decrypt fails on it — mismatched root key material, corrupted ciphertext, or external KMS rejecting the operation.","commonSituations":"Clusters upgraded from pre-1.7 (ed25519-only) with partially written RSA key material; keyring snapshots restored from another cluster; KMS auth issues at agent startup.","solutions":["Inspect the agent log for the wrapped error to identify the KMS/crypto failure","Verify the external KMS credentials and that the key still decrypts","Trigger a keyring rotation to regenerate a valid wrapped RSA key under the current root key","Confirm nodes are on Nomad >= 1.7 if relying on RSA-based workload identity JWTs"],"exampleFix":"// no caller fix; operator remediation\n// before: RSA key undecryptable -> workload identity JWT signing fails\n// after: nomad keyring rotate  (regenerates RSA key under current root key)","handlingStrategy":"validation","validationCode":"// after startup, verify RSA signing capability instead of assuming\nif _, err := encrypter.GetActiveKey(); err != nil { /* RSA/ed25519 keyring not ready */ }","typeGuard":"func hasRSAKey(ks *cipherSet) bool { return ks != nil && ks.rsaPrivateKey != nil }","tryCatchPattern":"// failure is log-only; detect downstream JWT-signing failures and fall back\nif err != nil { /* fall back to ed25519 signing or defer workload identity usage */ }","preventionTips":["Keep all agents on >= 1.7 before enabling RSA-based workload identity","Watch agent startup logs for rsa key decrypt warnings","Rotate the keyring after any snapshot restore from another cluster"],"tags":["encryption","kms","rsa","jwt-signing"],"backgroundTag":"decrypt-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}