{"record":{"id":"9b7b17629a41f1fb","repo":"hashicorp/nomad","slug":"unsupported-signature-algorithm-t-rsa-and-ecdsa","errorCode":null,"errorMessage":"Unsupported signature algorithm %T; RSA and ECDSA only are supported.","messagePattern":"Unsupported signature algorithm %T; RSA and ECDSA only are supported\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":447,"sourceCode":"\n\t// Default in case this function is called but TLS is not actually configured\n\t// This is only reached if the TLS certificate is nil\n\treturn []uint16{}, nil\n}\n\n// getSignatureAlgorithm returns the signature algorithm for a TLS certificate\n// This is determined by examining the type of the certificate's public key,\n// as Golang doesn't expose a more straightforward  API which returns this\n// type\nfunc getSignatureAlgorithm(tlsCert *tls.Certificate) (signatureAlgorithm, error) {\n\tprivKey := tlsCert.PrivateKey\n\tswitch privKey.(type) {\n\tcase *rsa.PrivateKey:\n\t\treturn rsaStringRepr, nil\n\tcase *ecdsa.PrivateKey:\n\t\treturn ecdsaStringRepr, nil\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"Unsupported signature algorithm %T; RSA and ECDSA only are supported.\", privKey)\n\t}\n}\n\n// ParseMinVersion parses the specified minimum TLS version for the Nomad agent\nfunc ParseMinVersion(version string) (uint16, error) {\n\tif version == \"\" {\n\t\treturn supportedTLSVersions[\"tls12\"], nil\n\t}\n\n\tvers, ok := supportedTLSVersions[version]\n\tif !ok {\n\t\treturn 0, fmt.Errorf(\"unsupported TLS version %q\", version)\n\t}\n\n\treturn vers, nil\n}\n\n// ShouldReloadRPCConnections compares two TLS Configurations and determines","sourceCodeStart":429,"sourceCodeEnd":465,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L429-L465","documentation":"getSignatureAlgorithm maps the private key type behind the TLS certificate to a signature-algorithm string ('RSA' or 'ECDSA') used by ParseCiphers. Only *rsa.PrivateKey and *ecdsa.PrivateKey are supported; any other key type (e.g. Ed25519) cannot be matched to cipher suites and triggers this error.","triggerScenarios":"ParseCiphers encounters a certificate whose private key is neither RSA nor ECDSA, e.g. an Ed25519 key, when checking cipher-suite compatibility.","commonSituations":"Issuing certs with modern Ed25519 keys (common with newer CAs/step-ca/CFSSL defaults) and feeding them to a library that only supports RSA/ECDSA cipher matching.","solutions":["Re-issue the certificate with an RSA-2048+ or ECDSA (P-256/P-384) key.","Configure the CA/template (e.g. step-ca or Vault PKI) to emit RSA or EC certificates.","If the key type cannot change, avoid ParseCiphers' signature check by not restricting tls_cipher_suites."],"exampleFix":"// before\nstep ca certificate svc.pem svc-key.pem --kty=OKP --curve=Ed25519\n// after\nstep ca certificate svc.pem svc-key.pem --kty=EC --curve=P-256","handlingStrategy":"validation","validationCode":"priv, err := parseKey(certFile, keyFile)\nif err != nil { return err }\nswitch priv.(type) {\ncase *rsa.PrivateKey, *ecdsa.PrivateKey:\n    // ok\ndefault:\n    return fmt.Errorf(\"key type %T unsupported; use RSA or ECDSA\", priv)\n}","typeGuard":"func isSupportedKey(k crypto.Signer) bool {\n    switch k.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Issue certificates with RSA or ECDSA (P-256/P-384) keys only.","Set explicit key type in CA templates (avoid Ed25519 defaults).","Check key type at issuance time in automation."],"tags":["tls","cryptography","key-type"],"backgroundTag":"unsupported-key-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}