{"record":{"id":"a23c4abedb260f3c","repo":"hyperledger/fabric","slug":"found-unknown-private-key-type-t-in-msg-signing","errorCode":null,"errorMessage":"found unknown private key type (%T) in msg signing","messagePattern":"found unknown private key type \\(%T\\) in msg signing","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/common/signer/signer.go","lineNumber":105,"sourceCode":"\t\treturn errors.Errorf(\"enrollment certificate should be a certificate, got a %s instead\", strings.ToLower(bl.Type))\n\t}\n\n\tif _, err := x509.ParseCertificate(bl.Bytes); err != nil {\n\t\treturn errors.Errorf(\"enrollment certificate is not a valid x509 certificate: %v\", err)\n\t}\n\treturn nil\n}\n\nfunc (si *Signer) Sign(msg []byte) ([]byte, error) {\n\tswitch key := si.key.(type) {\n\t// Fabric only supports ECDSA and ed25519 at the moment.\n\tcase *ecdsa.PrivateKey:\n\t\tdigest := util.ComputeSHA256(msg)\n\t\treturn signECDSA(si.key.(*ecdsa.PrivateKey), digest)\n\tcase ed25519.PrivateKey:\n\t\treturn ed25519.Sign(si.key.(ed25519.PrivateKey), msg), nil\n\tdefault:\n\t\treturn nil, errors.Errorf(\"found unknown private key type (%T) in msg signing\", key)\n\t}\n}\n\nfunc loadPrivateKey(file string) (crypto.PrivateKey, error) {\n\tb, err := os.ReadFile(file)\n\tif err != nil {\n\t\treturn nil, errors.WithStack(err)\n\t}\n\tbl, _ := pem.Decode(b)\n\tif bl == nil {\n\t\treturn nil, errors.Errorf(\"failed to decode PEM block from %s\", file)\n\t}\n\tkey, err := parsePrivateKey(bl.Bytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn key, nil\n}","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/cmd/common/signer/signer.go#L87-L123","documentation":"Signer.Sign switches on the concrete type of the loaded private key, supporting *ecdsa.PrivateKey and ed25519.PrivateKey only. If the key is of any other type (e.g. *rsa.PrivateKey), it returns this error. Fabric's signer tooling deliberately restricts supported key algorithms.","triggerScenarios":"Creating a Signer whose key file contains an RSA (or other unsupported) private key and calling Sign/Endorse/Send; a test or custom code path injecting a key of unexpected type into Signer.key.","commonSituations":"Using an RSA key issued by a CA or openssl by mistake instead of an ECDSA key; old materials generated with RSA; Fabric version changes dropping support for other key types.","solutions":["Generate/use an ECDSA (P-256) or Ed25519 private key; e.g. openssl ecparam -name prime256v1 -genkey -noout -out key.pem","Re-enroll with Fabric CA using an ECDSA key (csr.cn / key algorithm settings)","Check the key header: 'BEGIN RSA PRIVATE KEY' means unsupported — replace it","If this is a custom type in tests, extend the switch or use a supported key type"],"exampleFix":"// before: RSA key\nopenssl genrsa -out key.pem 2048\n// after: ECDSA key\nopenssl ecparam -name prime256v1 -genkey -noout -out key.pem","handlingStrategy":"try-catch","validationCode":"key, err := loadPrivateKey(keyPath)\nif err != nil { return err }\nswitch k := key.(type) {\ncase *ecdsa.PrivateKey, ed25519.PrivateKey:\ndefault:\n    return fmt.Errorf(\"unsupported key type %T in %s\", k, keyPath)\n}","typeGuard":"func isSupportedKey(k crypto.PrivateKey) bool {\n    switch k.(type) {\n    case *ecdsa.PrivateKey, ed25519.PrivateKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":"sig, err := signer.Sign(msg)\nif err != nil {\n    if strings.Contains(err.Error(), \"unknown private key type\") {\n        return fmt.Errorf(\"replace key with ECDSA/Ed25519: %w\", err)\n    }\n    return err\n}","preventionTips":["Always generate ECDSA P-256 or Ed25519 keys for Fabric identities","Reject RSA keys at provisioning time with a type check","Document key algorithm requirements in enrollment tooling"],"tags":["crypto","fabric","ecdsa","unsupported-key-type"],"backgroundTag":"unsupported-private-key-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}