{"record":{"id":"9af323d0da02a8c0","repo":"hashicorp/nomad","slug":"could-not-add-key-file-s-to-keystore-w","errorCode":null,"errorMessage":"could not add key file %s to keystore: %w","messagePattern":"could not add key file (.+?) to keystore: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"nomad/encrypter.go","lineNumber":195,"sourceCode":"\t\te.keyringLock.RLock()\n\t\t_, ok := e.keyring[id]\n\t\te.keyringLock.RUnlock()\n\t\tif ok {\n\t\t\treturn nil // already loaded this key from another file\n\t\t}\n\n\t\tkey, err := e.loadKeyFromStore(path)\n\t\tif err != nil {\n\t\t\tkeyErrors[id] = fmt.Errorf(\"could not load key file %s from keystore: %w\", path, err)\n\t\t\treturn nil\n\t\t}\n\t\tif key.Meta.KeyID != id {\n\t\t\treturn fmt.Errorf(\"root key ID %s must match key file %s\", key.Meta.KeyID, path)\n\t\t}\n\n\t\terr = e.addCipher(key)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not add key file %s to keystore: %w\", path, err)\n\t\t}\n\n\t\t// we loaded this key from at least one KEK configuration, so clear any\n\t\t// error from a previous file that we couldn't read from\n\t\tdelete(keyErrors, id)\n\t\treturn nil\n\t})\n\n\tif len(keyErrors) == 0 {\n\t\treturn nil\n\t}\n\n\tvar mErr multierror.Error\n\tfor _, err := range keyErrors {\n\t\tmErr = *multierror.Append(&mErr, err)\n\t}\n\treturn mErr.ErrorOrNil()\n}","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L177-L213","documentation":"addCipher rejected the root key after it was loaded from the key file. addCipher builds the cipher set (AEAD wrapper, ed25519/rsa signing keys); errors here mean the key material is structurally invalid (e.g. missing or malformed signing keys) and cannot be registered in the keyring.","triggerScenarios":"loadKeystore successfully loads and ID-verifies a key, then calls e.addCipher(key); addCipher returns an error when the key's algorithm is unknown or the embedded public/private key material cannot be reconstructed.","commonSituations":"Key file produced by a newer/older Nomad version with an unsupported algorithm field, hand-edited key JSON, or partially written file from a crash.","solutions":["Read the wrapped cause to see which part of addCipher failed (wrapper setup vs signing keys)","Verify all servers run compatible Nomad versions (same key algorithm support)","Restore the key file from a backup or another server's keystore","Rotate to a new key with nomad keyring rotate and remove the unusable key once no data is encrypted under it"],"exampleFix":"// before: mixed cluster versions produce unsupported key algorithm\n//   servers at 1.5.x cannot addCipher keys minted by 1.7.x\n// after: upgrade all servers to the same version, then restart\n$ nomad version && nomad server members  # confirm uniform versions","handlingStrategy":"validation","validationCode":"// confirm uniform Nomad versions across servers before rotations\n$ for s in $(nomad server members -format json | jq -r '.[].Name'); do nomad node status -verbose $s | grep Version; done","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep all servers on the same Nomad version, especially across key rotations","Never edit key file JSON by hand","Restore keys only from trusted backups of the same cluster","Test rotation in staging before production"],"tags":["keyring","cipher","key-rotation","go"],"backgroundTag":"cipher-setup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}