{"record":{"id":"722cd590e2e72599","repo":"grpc/grpc-java","slug":"signature-algorithm-d-is-not-supported","errorCode":null,"errorMessage":"Signature Algorithm %d is not supported.","messagePattern":"Signature Algorithm (.+?) is not supported\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"s2a/src/main/java/io/grpc/s2a/internal/handshaker/S2APrivateKeyMethod.java","lineNumber":94,"sourceCode":"\n  private S2APrivateKeyMethod(S2AStub stub, Optional<S2AIdentity> localIdentity) {\n    this.stub = stub;\n    this.localIdentity = localIdentity;\n  }\n\n  /**\n   * Converts the signature algorithm to an enum understood by S2A.\n   *\n   * @param signatureAlgorithm the int representation of the signature algorithm define by {@code\n   *     OpenSslPrivateKeyMethod}.\n   * @return the signature algorithm enum defined by S2A proto.\n   * @throws UnsupportedOperationException if the algorithm is not supported by S2A.\n   */\n  @VisibleForTesting\n  static SignatureAlgorithm convertOpenSslSignAlgToS2ASignAlg(int signatureAlgorithm) {\n    SignatureAlgorithm sig = OPENSSL_TO_S2A_SIGNATURE_ALGORITHM_MAP.get(signatureAlgorithm);\n    if (sig == null) {\n      throw new UnsupportedOperationException(\n          String.format(\"Signature Algorithm %d is not supported.\", signatureAlgorithm));\n    }\n    return sig;\n  }\n\n  /**\n   * Signs the input bytes by sending the request to the S2A srever.\n   *\n   * @param engine not used.\n   * @param signatureAlgorithm the {@link OpenSslPrivateKeyMethod}'s signature algorithm\n   *     representation\n   * @param input the bytes to be signed.\n   * @return the signature of the {@code input}.\n   * @throws IOException if the connection to the S2A server is corrupted.\n   * @throws InterruptedException if the connection to the S2A server is interrupted.\n   * @throws S2AConnectionException if the response from the S2A server does not contain valid data.\n   */\n  @Override","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/s2a/src/main/java/io/grpc/s2a/internal/handshaker/S2APrivateKeyMethod.java#L76-L112","documentation":"convertOpenSslSignAlgToS2ASignAlg translates an OpenSSL signature-algorithm ID (as reported by the TLS stack during signing) into the S2A handshaker's SignatureAlgorithm proto enum via a lookup map. When the OpenSSL algorithm has no mapping, it throws UnsupportedOperationException — the S2A client cannot express that signature algorithm to the S2A service.","triggerScenarios":"During an S2A-offloaded TLS handshake, s2aSignatureAlgorithm receives a signatureAlgorithm int from the SSL engine (e.g. Ed25519/Ed448, RSA-PSS variants, or a newer algorithm) that is absent from OPENSSL_TO_S2A_SIGNATURE_ALGORITHM_MAP.","commonSituations":"Using a cipher suite or certificate key type (EdDSA, RSA-PSS) the bundled S2A handshaker proto doesn't support; mismatched BoringSSL/OpenSSL version producing algorithm IDs the map doesn't cover; older s2a client library with a smaller map.","solutions":["Upgrade the gRPC s2a library so OPENSSL_TO_S2A_SIGNATURE_ALGORITHM_MAP includes the algorithm (check the @VisibleForTesting map contents).","Switch the certificate/key to a supported type, e.g. RSA (PKCS#1) or ECDSA P-256, avoiding EdDSA/RSA-PSS-only certs.","Restrict the TLS cipher suites/signature algorithms negotiated so only mapped algorithms are offered.","Log the offending signatureAlgorithm int and compare against the map to confirm which algorithm is unsupported."],"exampleFix":"// before\nKeyPair kp = generateEd25519KeyPair(); // algorithm unmapped\n// after\nKeyPair kp = generateRsa2048KeyPair(); // RSA sig alg supported by S2A map","handlingStrategy":"try-catch","validationCode":"static boolean isSupportedSigAlg(int opensslAlgId) {\n  return opensslAlgId == /* RSA */ NID_sha256WithRSAEncryption\n      || opensslAlgId == /* ECDSA */ NID_ecdsa_with_SHA256; // mirror the client's map\n}","typeGuard":null,"tryCatchPattern":"try {\n  byte[] sig = keyMethod.sign(engine, input);\n} catch (UnsupportedOperationException e) {\n  failHandshake(\"unsupported signature algorithm: \" + e.getMessage());\n}","preventionTips":["Use certificates with RSA or ECDSA P-256 keys; avoid EdDSA/RSA-PSS-only certs with S2A.","Restrict offered signature algorithms in TLS config to mapped ones.","Upgrade the s2a library to widen the algorithm map.","Log the failing algorithm ID to correlate with the map during triage."],"tags":["grpc","s2a","tls","signature-algorithm"],"backgroundTag":"unsupported-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}