{"record":{"id":"54656e8e6a8113d2","repo":"semaphoreui/semaphore","slug":"jwt-unsupported-curve-q-expected-p-256","errorCode":null,"errorMessage":"jwt: unsupported curve %q, expected P-256","messagePattern":"jwt: unsupported curve %q, expected P-256","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/jwt/signer.go","lineNumber":163,"sourceCode":"\tset := jose.JSONWebKeySet{Keys: []jose.JSONWebKey{jwk}}\n\treturn json.Marshal(set)\n}\n\nfunc parsePrivateKey(data []byte) (*ecdsa.PrivateKey, error) {\n\tblock, _ := pem.Decode(data)\n\tif block == nil {\n\t\treturn nil, errors.New(\"jwt: no PEM block found in key file\")\n\t}\n\tkey, err := x509.ParsePKCS8PrivateKey(block.Bytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tecKey, ok := key.(*ecdsa.PrivateKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"jwt: key is not ECDSA (got %T)\", key)\n\t}\n\tif ecKey.Curve != elliptic.P256() {\n\t\treturn nil, fmt.Errorf(\"jwt: unsupported curve %q, expected P-256\", ecKey.Curve.Params().Name)\n\t}\n\treturn ecKey, nil\n}\n\nfunc computeKID(pub *ecdsa.PublicKey) (string, error) {\n\tder, err := x509.MarshalPKIXPublicKey(pub)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tsum := sha256.Sum256(der)\n\treturn base64.RawURLEncoding.EncodeToString(sum[:]), nil\n}\n\nfunc randomJTI() (string, error) {\n\tvar b [16]byte\n\tif _, err := rand.Read(b[:]); err != nil {\n\t\treturn \"\", err\n\t}","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/pkg/jwt/signer.go#L145-L181","documentation":"Thrown by parsePrivateKey in pkg/jwt/signer.go when a PKCS#8 PEM key parses successfully as ECDSA but its elliptic curve is not P-256 (e.g. P-384, P-521, or a custom curve). The JWT signer deliberately requires ES256, which is only defined over P-256, so any other curve is rejected before the key is used for signing.","triggerScenarios":"Thrown at pkg/jwt/signer.go:163 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the signing key with an ECDSA P-256 curve (e.g. openssl ecparam -name prime256v1 -genkey -noout) and re-import the PEM","If the key was provisioned via config or the jwt_signing_key database option, replace that stored key with a P-256 PEM","Verify with 'openssl ec -in key.pem -text -noout' that the curve reports prime256v1 before deploying","If you cannot replace the key, disable the JWT feature until a compliant key is available, since the signer will not start"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}