{"record":{"id":"7442c68304626d6d","repo":"nats-io/nats-server","slug":"errbadpublickeyalgorithm","errorCode":"ErrBadPublicKeyAlgorithm","errorMessage":"unsupported public key algorithm","messagePattern":"unsupported public key algorithm","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":39,"sourceCode":"\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L21-L57","documentation":"ErrBadPublicKeyAlgorithm is returned when, after extracting the private key's algorithm group from the Windows store, the value is neither \"ECDSA\" nor \"RSA\" (the default branch at certstore_windows.go:766). The library only knows how to rebuild public keys for those two algorithm families; keys of any other algorithm group cannot be mapped to a Go public key.","triggerScenarios":"TLSConfig build on Windows with a store certificate whose NCRYPT_ALGORITHM_GROUP_PROPERTY returns an unrecognized value (not \"ECDSA\"/\"RSA\") — e.g. DH, DSA, or a vendor-specific algorithm group string — hitting `default: return nil, ErrBadPublicKeyAlgorithm` at :766.","commonSituations":"Certificates issued with legacy DSA or DH keys; vendor KSPs reporting nonstandard algorithm-group names; misprovisioned test certificates; keys migrated between KSPs with altered algorithm metadata.","solutions":["Reissue the certificate with an RSA or ECDSA key — other algorithm groups are not supported by TLS/this library.","Print/log the key's algorithm-group property to identify what the KSP actually reports.","Use a standard Microsoft KSP so the algorithm group is reported with the canonical \"RSA\"/\"ECDSA\" names.","Replace legacy DSA/DH certificates, which modern TLS stacks reject anyway."],"exampleFix":"// before: DSA key -> ErrBadPublicKeyAlgorithm\n// after: reissue with RSA\n// openssl genrsa -out server.key 2048 && reissue cert","handlingStrategy":"validation","validationCode":"// before TLS setup, check the key algorithm group is one the library supports\nalg, err := keyAlgorithmGroup(handle)\nif err != nil || (alg != \"RSA\" && alg != \"ECDSA\") {\n    return fmt.Errorf(\"key algorithm %q unsupported; reissue cert with RSA or ECDSA\", alg)\n}","typeGuard":"func isSupportedKeyAlgGroup(alg string) bool {\n    return alg == \"RSA\" || alg == \"ECDSA\"\n}","tryCatchPattern":"if errors.Is(err, certstore.ErrBadPublicKeyAlgorithm) {\n    return fmt.Errorf(\"replace the certificate with an RSA or ECDSA key: %w\", err)\n}","preventionTips":["Only issue certificates with RSA or ECDSA keys for TLS use.","Beware vendor KSPs reporting nonstandard algorithm-group strings.","Replace legacy DSA/DH certificates — modern TLS rejects them anyway.","Log the algorithm-group property when onboarding new certificate sources."],"tags":["windows","certificate-store","public-key","algorithm","key-metadata"],"backgroundTag":"unsupported-key-algorithm","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}