{"record":{"id":"6c9cc1bb1649c08b","repo":"nats-io/nats-server","slug":"errbadsigningalgorithm","errorCode":"ErrBadSigningAlgorithm","errorMessage":"unsupported signing algorithm","messagePattern":"unsupported signing algorithm","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":15,"sourceCode":"package certstore\n\nimport (\n\t\"errors\"\n)\n\nvar (\n\t// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store\n\tErrBadCryptoStoreProvider = errors.New(\"unable to open certificate store or store not available\")\n\n\t// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm\n\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L1-L33","documentation":"ErrBadSigningAlgorithm is returned when the Windows certificate-store signer receives signing options whose concrete type does not match any supported signing option type (RSA PSS/PKCS1 or ECDSA). The switch `switch opts.(type)` in the Sign implementation at certstore_windows.go:558 falls through to the default branch because the option type is unrecognized, so the library cannot determine how to perform the signature.","triggerScenarios":"Calling Sign on a store-backed signer (from TLSConfig's certificate/private key path on Windows) with opts that is neither *rsa.PSSOptions, *rsa.Options-style RSA options, nor *ecdsa.Options — e.g. passing nil opts, crypto.Hash alone in an unsupported shape, or a custom options type.","commonSituations":"Wrapping or proxying crypto.Signer and forwarding wrong option types; passing nil options where the signer expects typed options; using a newer Go stdlib options type not yet handled by this code; calling the signer directly from application code instead of through crypto/tls.","solutions":["Call the signer through crypto/tls (TLSConfig) so it receives standard option types automatically.","If calling Sign directly, pass the correct options type: *rsa.PSSOptions for RSA-PSS, rsa/dsa PKCS1 defaults for RSA, or the ECDSA options type for ECC keys.","Verify the key's algorithm and match options to it (RSA options for RSA keys, ECDSA options for ECC keys).","Check the switch at certstore_windows.go:558 for the exact list of accepted option types in this version."],"exampleFix":"// before\nsig, err := signer.Sign(rand, digest, nil)\n// after\nsig, err := signer.Sign(rand, digest, crypto.SHA256) // let stdlib options flow, or pass *rsa.PSSOptions / ECDSA options","handlingStrategy":"validation","validationCode":"// ensure opts is a type the store signer understands before calling\nswitch opts.(type) {\ncase *rsa.PSSOptions, *rsa.PrivateKey, *ecdsa.Options, nil:\n    // acceptable per signer's switch\ndefault:\n    opts = nil // or construct a supported options type\n}","typeGuard":"func isSupportedSignOpts(o crypto.SignerOpts) bool {\n    switch o.(type) {\n    case nil, crypto.Hash, *rsa.PSSOptions, *ecdsa.Options:\n        return true\n    }\n    return false\n}","tryCatchPattern":"sig, err := signer.Sign(rand, digest, opts)\nif errors.Is(err, certstore.ErrBadSigningAlgorithm) {\n    return fmt.Errorf(\"unsupported sign options %T: %w\", opts, err)\n}","preventionTips":["Call the signer through crypto/tls instead of invoking Sign directly with custom options.","Match option types to the key algorithm (RSA options for RSA keys, ECDSA options for ECC keys).","Don't wrap the signer in proxies that change the options type."],"tags":["windows","certificate-store","signing","type-mismatch"],"backgroundTag":"unsupported-signing-algorithm","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}