{"record":{"id":"bf015d0d59866384","repo":"gchq/CyberChef","slug":"unsupported-public-key-type","errorCode":null,"errorMessage":"Unsupported public key type","messagePattern":"Unsupported public key type","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PubKeyFromCert.mjs","lineNumber":57,"sourceCode":"        let match;\n        const regex = /-----BEGIN CERTIFICATE-----/g;\n        while ((match = regex.exec(input)) !== null) {\n            // find corresponding end tag\n            const indexBase64 = match.index + match[0].length;\n            const footer = \"-----END CERTIFICATE-----\";\n            const indexFooter = input.indexOf(footer, indexBase64);\n            if (indexFooter === -1) {\n                throw new OperationError(`PEM footer '${footer}' not found`);\n            }\n\n            const certPem = input.substring(match.index, indexFooter + footer.length);\n            const cert = new r.X509();\n            cert.readCertPEM(certPem);\n            let pubKey;\n            try {\n                pubKey = cert.getPublicKey();\n            } catch {\n                throw new OperationError(\"Unsupported public key type\");\n            }\n            const pubKeyPem = r.KEYUTIL.getPEM(pubKey);\n\n            // PEM ends with '\\n', so a new key always starts on a new line\n            output += pubKeyPem;\n        }\n        return output;\n    }\n}\n\nexport default PubKeyFromCert;\n","sourceCodeStart":39,"sourceCodeEnd":69,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PubKeyFromCert.mjs#L39-L69","documentation":"After loading the PEM, PubKeyFromCert calls jsrsasign's cert.getPublicKey(); if that throws, the op reports 'Unsupported public key type'. getPublicKey throws for key algorithms/jsrsasign does not recognize or cannot parse (for example some EdDSA/Ed25519, exotic curves, or a malformed SubjectPublicKeyInfo). The catch is intentionally broad, so the original jsrsasign error is not surfaced.","triggerScenarios":"A certificate carrying a public key algorithm the bundled jsrsasign does not support (e.g. Ed25519/Ed448 on older jsrsasign); a malformed SPKI; a certificate with an unknown curve OID; a corrupted cert that still parses at the SEQUENCE level.","commonSituations":"Modern certificates using algorithms jsrsasign lags on; cross-version certificate suites; hand-crafted or damaged certs; using a CyberChef build with an older jsrsasign.","solutions":["Extract the key with openssl instead: 'openssl x509 -in cert.pem -pubkey -noout'.","Upgrade CyberChef (and thus the bundled jsrsasign) for broader algorithm support.","Confirm the cert is well-formed with 'openssl x509 -in cert.pem -noout -text'.","If the algorithm is supported by a newer jsrsasign, report it so the dependency can be updated."],"exampleFix":"// before: cert with unsupported key type\nrun(ed25519CertPem, []);\n\n// after: extract with openssl externally\n// openssl x509 -in cert.pem -pubkey -noout > pubkey.pem","handlingStrategy":"try-catch","validationCode":"// No general pre-check: getPublicKey() failure depends on jsrsasign's algorithm support.\n// Probe the key algorithm OID first if you have an ASN.1 parser, else fall back to try/catch.","typeGuard":"function isLikelySupportedKeyAlgorithm(certPem) {\n  // Best-effort: returns false for known-unsupported OIDs like Ed25519 (1.3.101.112)\n  return !/1\\.3\\.101\\.11[0-9]/.test(certPem);\n}","tryCatchPattern":"try {\n  return pubKeyFromCert.run(certPem, []);\n} catch (e) {\n  if (e.message === \"Unsupported public key type\") {\n    // fall back to openssl: openssl x509 -in cert.pem -pubkey -noout\n  }\n  throw e;\n}","preventionTips":["Extract the key with openssl as a fallback for modern algorithms.","Keep CyberChef/jsrsasign up to date for broader support.","Validate the cert with openssl x509 -text first."],"tags":["crypto","x509","certificate","public-key","jsrsasign"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}