{"record":{"id":"6e1c7def5b666e44","repo":"caddyserver/caddy","slug":"unsupported-key-type-t","errorCode":null,"errorMessage":"unsupported key type: %T","messagePattern":"unsupported key type: %T","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/crypto.go","lineNumber":154,"sourceCode":"\t\t}\n\tcase *ecdsa.PublicKey:\n\t\tpk, ok := signer.Public().(*ecdsa.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tcase ed25519.PublicKey:\n\t\tpk, ok := signer.Public().(ed25519.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported key type: %T\", pub)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":136,"sourceCodeEnd":159,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/crypto.go#L136-L159","documentation":"Returned by verifyKeysMatch (modules/caddypki/crypto.go:154) when the public key embedded in the certificate being loaded is not RSA, ECDSA, or Ed25519. Caddy's PKI only knows how to verify these three key families, so any other algorithm in the cert's SubjectPublicKeyInfo fails here at the default switch case.","triggerScenarios":"Supplying a CA root or intermediate certificate whose public key uses an unsupported algorithm (e.g. DSA, Ed448, or an ECDH-typed key) via the root/intermediate cert_file/key_file config. The error fires during provisioning when the chain is read and verifyKeysMatch is called with the loaded certificate and signer.","commonSituations":"Importing certificates from legacy or exotic CAs that still use DSA; keys generated by experimental tooling (Ed448, Dilithium/PQC pilots); OpenSSL-generated ECDH keys mistakenly used where an ECDSA signing key was required.","solutions":["Re-issue the CA certificate with a supported key algorithm: RSA (>=2048), ECDSA (P-256/P-384/P-521), or Ed25519","Check the algorithm before importing: openssl x509 -in cert.pem -noout -text | grep 'Public Key Algorithm'","If you must keep the external CA, terminate its certificates in the TLS app instead of loading it as a Caddy PKI root/intermediate"],"exampleFix":"# before: DSA root\nopenssl dsaparam -genkey 2048 > d.key && openssl req -x509 -new -key d.key ...\n\n# after: ECDSA root\nopenssl ecparam -name prime256v1 -genkey -noout -out key.pem\nopenssl req -x509 -new -key key.pem -subj '/CN=My Root' -days 3650 -out root.crt","handlingStrategy":"validation","validationCode":"// reject unsupported algorithms before handing certs to Caddy\nfunc isSupportedCertAlgorithm(certFile string) (bool, error) {\n\tout, err := exec.Command(\"openssl\", \"x509\", \"-in\", certFile, \"-noout\", \"-text\").Output()\n\tif err != nil {\n\t\treturn false, err\n\t}\n\ttxt := string(out)\n\treturn strings.Contains(txt, \"rsaEncryption\") ||\n\t\tstrings.Contains(txt, \"id-ecPublicKey\") ||\n\t\tstrings.Contains(txt, \"ED25519\"), nil\n}","typeGuard":"// Go-side guard using the parsed certificate\nfunc certUsesSupportedKey(crt *x509.Certificate) bool {\n\tswitch crt.PublicKey.(type) {\n\tcase *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":"if err := ca.Provision(ctx, caID, p.log); err != nil {\n    if strings.Contains(err.Error(), \"unsupported key type\") {\n        // algorithm-level problem: re-issue the CA cert with RSA/ECDSA/Ed25519\n    }\n    return err\n}","preventionTips":["Standardize your PKI on P-256 ECDSA or RSA-2048; both are universally supported by Caddy","When importing third-party CA certs, check the key algorithm with openssl before adding them to Caddy's pki config","Keep DSA/Ed448/PQC keys out of CA certificates used by Caddy's internal PKI"],"tags":["pki","crypto","unsupported-algorithm","certificate"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}