{"record":{"id":"55c50c044f214ee1","repo":"hashicorp/nomad","slug":"error-parsing-s-public-key-w","errorCode":null,"errorMessage":"error parsing %s public key: %w","messagePattern":"error parsing (.+?) public key: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/keyring.go","lineNumber":582,"sourceCode":"\t// a new key. Therefore this field can be used for cache control.\n\tCreateTime int64\n}\n\n// GetPublicKey returns the concrete PublicKey type. This *must* be used to\n// retrieve the public key as functions such as go-jose's Claims(pubKey,\n// claims) inspect pubKey's concrete type.\nfunc (pubKey *KeyringPublicKey) GetPublicKey() (any, error) {\n\tswitch alg := pubKey.Algorithm; alg {\n\n\tcase PubKeyAlgEdDSA:\n\t\t// Convert public key bytes to an ed25519 public key\n\t\treturn ed25519.PublicKey(pubKey.PublicKey), nil\n\n\tcase PubKeyAlgRS256:\n\t\t// PEM -> rsa.PublickKey\n\t\trsaPubKey, err := x509.ParsePKCS1PublicKey(pubKey.PublicKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing %s public key: %w\", alg, err)\n\t\t}\n\t\treturn rsaPubKey, nil\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown algorithm: %q\", alg)\n\t}\n}\n\n// KeyringGetConfigResponse is the response for Keyring.GetConfig RPCs.\ntype KeyringGetConfigResponse struct {\n\tOIDCDiscovery *OIDCDiscoveryConfig\n}\n\n// OIDCDiscoveryConfig represents the response to OIDC Discovery requests\n// usually at: /.well-known/openid-configuration\n//\n// Only the fields Nomad uses are implemented since many fields in the\n// specification are not relevant to Nomad's use case:","sourceCodeStart":564,"sourceCodeEnd":600,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/keyring.go#L564-L600","documentation":"This error is returned by the keyring public-key parsing helper in nomad/structs/keyring.go when a PEM-encoded key declared with the RS256 (RSA) algorithm cannot be decoded into an rsa.PublicKey. x509.ParsePKCS1PublicKey failed, meaning the underlying DER bytes are not a valid PKCS#1 RSA public key. Nomad wraps the underlying parse error with the algorithm name so the operator knows which key failed.","triggerScenarios":"Calling keyring config/JWKS-related APIs (e.g. workload identity / OIDC key setup) where a key loaded via ParsePublicKey or similar has PubKeyAlgRS256 but its PEM payload decodes to something else — e.g. a PKIX SubjectPublicKeyInfo, a PKCS#8 private key, an EC key, or corrupted base64/DER bytes.","commonSituations":"Operators paste an EC or Ed25519 public key while configuring signing_algorithm = \"RS256\"; a key was exported in SPKI/PKIX format (openssl pkey -pubout) instead of PKCS#1 (openssl rsa -RSAPublicKey_out); the key file was truncated or contains a certificate instead of a raw public key.","solutions":["Re-export the key as a PKCS#1 RSA public key: openssl rsa -in key.pem -RSAPublicKey_out -out rsapub.pem, and reconfigure Nomad with it","Confirm the key's algorithm field matches the key type (RS256 for RSA); if the key is EC/Ed25519, switch the configured algorithm instead of the key","Inspect the wrapped inner error (%w) — e.g. 'asn1: structure error' points at malformed DER, while type mismatches indicate the wrong PEM format","Verify the PEM block is a PUBLIC KEY/RSA PUBLIC KEY block, not a CERTIFICATE or PRIVATE KEY block"],"exampleFix":"// before (PEM is PKIX/SPKI, fails PKCS1 parse)\nsigning_key = \"-----BEGIN PUBLIC KEY-----\\n...\\n-----END PUBLIC KEY-----\"\n// after (convert to PKCS#1)\n// openssl rsa -pubin -in pub.pem -RSAPublicKey_out -out rsapub.pem\nsigning_key = \"-----BEGIN RSA PUBLIC KEY-----\\n...\\n-----END RSA PUBLIC KEY-----\"","handlingStrategy":"validation","validationCode":"func validateRSAPublicKeyPEM(pemBytes []byte) error {\n\tblock, _ := pem.Decode(pemBytes)\n\tif block == nil { return fmt.Errorf(\"no PEM block\") }\n\tif _, err := x509.ParsePKCS1PublicKey(block.Bytes); err != nil {\n\t\treturn fmt.Errorf(\"not a PKCS#1 RSA public key: %w\", err)\n\t}\n\treturn nil\n}","typeGuard":"func isPKCS1RSAPublicKey(pemBytes []byte) bool {\n\tblock, _ := pem.Decode(pemBytes)\n\tif block == nil { return false }\n\t_, err := x509.ParsePKCS1PublicKey(block.Bytes)\n\treturn err == nil\n}","tryCatchPattern":null,"preventionTips":["Export RSA keys in PKCS#1 format (openssl rsa -RSAPublicKey_out) when Nomad expects RS256","Match key type to algorithm: RSA keys for RS256, Ed25519 keys for Ed25519","Never paste CERTIFICATE or PRIVATE KEY PEM blocks where a public key is expected","Validate keys with openssl pkey -pubin -text before configuring"],"tags":["nomad","keyring","rsa","x509","pem"],"backgroundTag":"invalid-public-key-format","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}