{"record":{"id":"81c685e1d1b5b17a","repo":"jwtk/jjwt","slug":"unable-to-compute-getid-signature-with-jca-al","errorCode":null,"errorMessage":"Unable to compute ${getId()} signature with JCA algorithm '${getJcaName()}' using key {${key}}: ${e.getMessage()}","messagePattern":"Unable to compute (.+?) signature with JCA algorithm '(.+?)' using key (.+?): (.+?)","errorType":"exception","errorClass":"SignatureException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/AbstractSecureDigestAlgorithm.java","lineNumber":54,"sourceCode":"        return signing ? \"signing\" : \"verification\";\n    }\n\n    protected abstract void validateKey(Key key, boolean signing);\n\n    @Override\n    public final byte[] digest(SecureRequest<InputStream, S> request) throws SecurityException {\n        Assert.notNull(request, \"Request cannot be null.\");\n        final S key = Assert.notNull(request.getKey(), \"Signing key cannot be null.\");\n        Assert.notNull(request.getPayload(), \"Request content cannot be null.\");\n        try {\n            validateKey(key, true);\n            return doDigest(request);\n        } catch (SignatureException | KeyException e) {\n            throw e; //propagate\n        } catch (Exception e) {\n            String msg = \"Unable to compute \" + getId() + \" signature with JCA algorithm '\" + getJcaName() + \"' \" +\n                    \"using key {\" + KeysBridge.toString(key) + \"}: \" + e.getMessage();\n            throw new SignatureException(msg, e);\n        }\n    }\n\n    protected abstract byte[] doDigest(SecureRequest<InputStream, S> request) throws Exception;\n\n    @Override\n    public final boolean verify(VerifySecureDigestRequest<V> request) throws SecurityException {\n        Assert.notNull(request, \"Request cannot be null.\");\n        final V key = Assert.notNull(request.getKey(), \"Verification key cannot be null.\");\n        Assert.notNull(request.getPayload(), \"Request content cannot be null or empty.\");\n        Assert.notEmpty(request.getDigest(), \"Request signature byte array cannot be null or empty.\");\n        try {\n            validateKey(key, false);\n            return doVerify(request);\n        } catch (SignatureException | KeyException e) {\n            throw e; //propagate\n        } catch (Exception e) {\n            String msg = \"Unable to verify \" + getId() + \" signature with JCA algorithm '\" + getJcaName() + \"' \" +","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/AbstractSecureDigestAlgorithm.java#L36-L72","documentation":"AbstractSecureDigestAlgorithm.digest catches unexpected exceptions from the JCA Signature/Mac layer and rethrows them as SignatureException with algorithm id, JCA name, key description, and cause message. SignatureException and KeyException are propagated unchanged; anything else (e.g. NoSuchAlgorithmException, provider errors) is wrapped.","triggerScenarios":"Computing a signature where the underlying JCA operation fails: algorithm unavailable in the provider, key incompatible with the JCA algorithm, or an I/O error reading the payload stream.","commonSituations":"Missing JCE provider (e.g. no EdDSA provider on old JDKs); weak-key restrictions on some JVMs; wrong key class passed to the algorithm; corrupted payload stream.","solutions":["Inspect the wrapped cause via e.getCause() to find the JCA-level failure.","Verify the JCA algorithm name is available: Signature.getInstance(name) works on your JVM.","Ensure the key matches the algorithm family (e.g. an EC PrivateKey for ES256).","Add/initialize the required security provider (Security.addProvider(new BouncyCastleProvider()))."],"exampleFix":"// before\nbyte[] sig = alg.sign(req); // may throw SignatureException: ... Caused by NoSuchAlgorithmException\n// after\nif (Security.getProvider(\"BC\") == null) Security.addProvider(new BouncyCastleProvider());\nbyte[] sig = alg.sign(req);","handlingStrategy":"try-catch","validationCode":"try { Signature.getInstance(alg.getJcaName()); } catch (NoSuchAlgorithmException e) { /* provider lacks algorithm */ }","typeGuard":"boolean canSign(Key k) { return k instanceof PrivateKey || k instanceof SecretKey; }","tryCatchPattern":"try { byte[] d = alg.digest(req); }\ncatch (SignatureException e) { throw new CryptoException(\"signing failed\", e.getCause()); }","preventionTips":["Verify the JCA algorithm is available on the runtime JVM.","Install providers (BouncyCastle) for missing algorithms.","Match key family to algorithm (EC key for ES256, etc.)."],"tags":["signature","jca","crypto","jjwt"],"backgroundTag":"signature-verification-failed","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}