{"record":{"id":"b6f59fa077b9dd9d","repo":"apache/rocketmq","slug":"10015","errorCode":"10015","errorMessage":"[10015:signature-failed] unable to calculate a request signature. error=%s","messagePattern":"\\[10015:signature-failed\\] unable to calculate a request signature\\. error=(.+?)","errorType":"validation","errorClass":"AclException","httpStatus":null,"severity":"error","filePath":"client/src/main/java/org/apache/rocketmq/acl/common/AclSigner.java","lineNumber":53,"sourceCode":"\n    public static String calSignature(String data, String key) throws AclException {\n        return calSignature(data, key, DEFAULT_ALGORITHM, DEFAULT_CHARSET);\n    }\n\n    public static String calSignature(String data, String key, SigningAlgorithm algorithm,\n        Charset charset) throws AclException {\n        return signAndBase64Encode(data, key, algorithm, charset);\n    }\n\n    private static String signAndBase64Encode(String data, String key, SigningAlgorithm algorithm, Charset charset)\n        throws AclException {\n        try {\n            byte[] signature = sign(data.getBytes(charset), key.getBytes(charset), algorithm);\n            return new String(Base64.encodeBase64(signature), DEFAULT_CHARSET);\n        } catch (Exception e) {\n            String message = String.format(CAL_SIGNATURE_FAILED_MSG, CAL_SIGNATURE_FAILED, e.getMessage());\n            log.error(message, e);\n            throw new AclException(\"CAL_SIGNATURE_FAILED\", CAL_SIGNATURE_FAILED, message, e);\n        }\n    }\n\n    private static byte[] sign(byte[] data, byte[] key, SigningAlgorithm algorithm) throws AclException {\n        try {\n            Mac mac = Mac.getInstance(algorithm.toString());\n            mac.init(new SecretKeySpec(key, algorithm.toString()));\n            return mac.doFinal(data);\n        } catch (Exception e) {\n            String message = String.format(CAL_SIGNATURE_FAILED_MSG, CAL_SIGNATURE_FAILED, e.getMessage());\n            log.error(message, e);\n            throw new AclException(\"CAL_SIGNATURE_FAILED\", CAL_SIGNATURE_FAILED, message, e);\n        }\n    }\n\n    public static String calSignature(byte[] data, String key) throws AclException {\n        return calSignature(data, key, DEFAULT_ALGORITHM, DEFAULT_CHARSET);\n    }","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/client/src/main/java/org/apache/rocketmq/acl/common/AclSigner.java#L35-L71","documentation":"Thrown by AclSigner.signAndBase64Encode when the client cannot compute the HMAC request signature required by RocketMQ ACL. The String-based calSignature path encodes data/key with the given charset, runs Mac over them, and Base64-encodes the result; any exception in that pipeline is wrapped as AclException code 10015 (CAL_SIGNATURE_FAILED). It always wraps an underlying cause (e.g. UnsupportedCharsetException, InvalidKeyException).","triggerScenarios":"Calling AclSigner.calSignature(data, key, algorithm, charset) or any ACL-enabled client operation (send/consume with aclEnable=true) with an unsupported charset name, a null/empty secret key that makes SecretKeySpec invalid, or a JCA provider missing the requested Mac algorithm.","commonSituations":"Misconfigured plain_acl.yml with an empty AccessSecret; JDK without the requested algorithm (e.g. HmacSHA384/512 on restricted JVMs); passing a custom SigningAlgorithm string that is not a valid Mac name; FIPS JVMs that disable HmacSHA1.","solutions":["Check the wrapped cause in the log line (log.error prints the full stack) to see whether it is InvalidKeyException, NoSuchAlgorithmException, or a charset problem.","Verify the AccessSecret in the ACL config file is non-empty and correctly copied (no whitespace/newline) on both client and broker.","Use a standard algorithm (HmacSHA1 is the default; HmacSHA256 is safe on stock JDKs) and a standard charset (UTF-8).","On restricted/FIPS JVMs, add a JCA provider that supports the algorithm or switch the algorithm to one the provider allows."],"exampleFix":"// before\nString sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA384, Charset.forName(\"UTF-16\"));\n\n// after\nString sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA256, StandardCharsets.UTF_8);","handlingStrategy":"try-catch","validationCode":"import javax.crypto.Mac;\nimport java.nio.charset.StandardCharsets;\n\nstatic boolean signatureConfigOk(String secretKey, String algorithm) {\n    if (secretKey == null || secretKey.isEmpty()) return false;\n    try {\n        Mac.getInstance(algorithm);\n        return true;\n    } catch (Exception e) {\n        return false;\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    String sig = AclSigner.calSignature(data, secretKey, SigningAlgorithm.HmacSHA1, StandardCharsets.UTF_8);\n} catch (AclException e) {\n    // code 10015: inspect e.getCause() for InvalidKey/NoSuchAlgorithm/charset detail\n    throw new IllegalStateException(\"ACL signature misconfigured: \" + e.getMessage(), e);\n}","preventionTips":["Fail fast at startup: run one calSignature smoke test with the configured credentials.","Keep AccessSecret in a secret manager and inject it; never hand-edit it into config where whitespace can creep in.","Pin the algorithm explicitly (HmacSHA1 or HmacSHA256) so JVM/provider changes cannot silently break it."],"tags":["rocketmq","acl","authentication","hmac","security"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}