{"record":{"id":"b6d20f25ed891078","repo":"shadow1ng/fscan","slug":"unsupported-public-key-type-t","errorCode":null,"errorMessage":"unsupported public key type: %T","messagePattern":"unsupported public key type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/gcc/gcc.go","lineNumber":434,"sourceCode":"\t}\n\tif cert.PublicKey == nil {\n\t\tvar pubKeyInfo struct {\n\t\t\tAlgorithm        pkix.AlgorithmIdentifier\n\t\t\tSubjectPublicKey asn1.BitString\n\t\t}\n\t\t_, err = asn1.Unmarshal(cert.RawSubjectPublicKeyInfo, &pubKeyInfo)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unmarshal public key info: %w\", err)\n\t\t}\n\t\trsaPublicKey, err := x509.ParsePKCS1PublicKey(pubKeyInfo.SubjectPublicKey.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"parse PKCS1 public key: %w\", err)\n\t\t}\n\t\treturn rsaPublicKey, nil\n\t}\n\trsaPublicKey, ok := cert.PublicKey.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"unsupported public key type: %T\", cert.PublicKey)\n\t}\n\treturn rsaPublicKey, nil\n}\nfunc (x *X509CertificateChain) Verify() bool {\n\treturn true\n}\nfunc (x *X509CertificateChain) Encrypt() []byte {\n\t//todo\n\treturn nil\n}\nfunc (x *X509CertificateChain) Unpack(r io.Reader) error {\n\treturn struc.Unpack(r, x)\n}\n\ntype ServerCoreData struct {\n\tRdpVersion              VERSION `struc:\"uint32,little\"`\n\tClientRequestedProtocol uint32  `struc:\"little\"`\n\tEarlyCapabilityFlags    uint32  `struc:\"little\"`","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/gcc/gcc.go#L416-L452","documentation":"When the certificate does carry a non-nil PublicKey, the library asserts it is an *rsa.PublicKey via a type assertion. Any other key type (ECDSA, Ed25519, etc.) fails the assertion and yields 'unsupported public key type: %T'. grdp only supports RSA server keys because the RDP standard security handshake uses RSA for the client random exchange.","triggerScenarios":"Connecting to an RDP host whose certificate uses an ECDSA/Ed25519 public key instead of RSA; the GCC cert chain parses fine but the key type is incompatible with grdp's key exchange.","commonSituations":"Modern/custom TLS configurations or non-Windows RDP implementations issuing ECC certificates; hardened environments that mandate ECC.","solutions":["Issue an RSA-based certificate for the RDP host (2048-bit+ RSA) — RSA is the expected RDP server key type.","Check cert.PublicKey's dynamic type via the %T text in the error to confirm which algorithm was found.","Extend the library to support the key type if you control the codebase and the protocol allows it.","Force the server to use standard RDP security/NLA with RSA keys."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"switch cert.PublicKey.(type) {\ncase *rsa.PublicKey:\n\t// ok\ndefault:\n\treturn errors.New(\"server certificate key must be RSA\")\n}","typeGuard":"func isRSAPublicKey(cert *x509.Certificate) bool {\n\t_, ok := cert.PublicKey.(*rsa.PublicKey)\n\treturn ok\n}","tryCatchPattern":"pub, err := certChain.PublicKey()\nif err != nil && strings.Contains(err.Error(), \"unsupported public key type\") {\n\treturn fmt.Errorf(\"host uses non-RSA server key; reissue RSA cert or skip host: %v\", err)\n}","preventionTips":["Issue RSA (>=2048-bit) certificates on RDP servers.","Pre-check cert.PublicKey type before key-exchange code paths.","Record %T in triage logs to identify offending algorithms.","Avoid hardened ECC-only TLS policies on RDP endpoints."],"tags":["rsa","x509","unsupported","rdp"],"backgroundTag":"type-mismatch","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}