{"record":{"id":"e08353df5990826a","repo":"hashicorp/nomad","slug":"failed-to-encrypt-rsa-key-w","errorCode":null,"errorMessage":"failed to encrypt rsa key: %w","messagePattern":"failed to encrypt rsa key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":890,"sourceCode":"\n\trootBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to encrypt root key: %w\", err)\n\t}\n\n\tkekWrapper := &structs.WrappedKey{\n\t\tProvider:                 provider.Provider.String(),\n\t\tProviderID:               provider.ID(),\n\t\tWrappedDataEncryptionKey: rootBlob,\n\t\tWrappedRSAKey:            &kms.BlobInfo{},\n\t\tKeyEncryptionKey:         kek,\n\t}\n\n\t// Only cipherSets created after 1.7.0 will contain an RSA key.\n\tif len(rootKey.RSAKey) > 0 {\n\t\trsaBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.RSAKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to encrypt rsa key: %w\", err)\n\t\t}\n\t\tkekWrapper.WrappedRSAKey = rsaBlob\n\t}\n\n\treturn kekWrapper, nil\n}\n\nfunc (e *Encrypter) writeKeyToDisk(\n\tmeta *structs.RootKeyMeta, provider *structs.KEKProviderConfig,\n\twrappedKey *structs.WrappedKey, kek []byte) (string, error) {\n\n\t// the on-disk keystore flattens the keys wrapped for the individual\n\t// KMS providers out to their own files\n\tdiskWrapper := &structs.KeyEncryptionKeyWrapper{\n\t\tMeta:                     meta,\n\t\tProvider:                 provider.Name,\n\t\tProviderID:               provider.ID(),\n\t\tWrappedDataEncryptionKey: wrappedKey.WrappedDataEncryptionKey,","sourceCodeStart":872,"sourceCodeEnd":908,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L872-L908","documentation":"Cipher sets created after Nomad 1.7.0 carry an RSA key (used for signing workload-identity JWTs) alongside the root key. encryptDEK re-encrypts this RSA key with the same KEK wrapper; failure is wrapped as \"failed to encrypt rsa key\". The root key blob succeeded, but the full KEKWrapper cannot be completed.","triggerScenarios":"wrapper.Encrypt(e.srv.shutdownCtx, rootKey.RSAKey) returns an error while the root key has a non-empty RSAKey — same KMS failure modes as the root key encrypt but during the second Encrypt call.","commonSituations":"Transient KMS backend error or credential expiry between the two Encrypt calls; payload-size limits on the KMS provider if the RSA key is large; rate limiting on the KMS API.","solutions":["Retry the wrap operation — the root-key encrypt succeeded previously, so transient errors are plausible.","Check KMS provider payload size limits vs. the RSA key blob size.","Verify credentials/permissions are still valid at the time of the second call.","Check backend logs for rate limiting or throttling responses."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"blob, err := encryptDEK(...)\nif err != nil && strings.Contains(err.Error(), \"failed to encrypt rsa key\") {\n    // retry with backoff; check KMS payload-size limits and throttling\n}","preventionTips":["Confirm the KMS provider's max ciphertext size comfortably exceeds the RSA key blob.","Apply exponential backoff on KMS API calls to ride out throttling.","Keep credentials valid for the duration of the whole wrap operation."],"tags":["kms","rsa","encryption"],"backgroundTag":"kms-encrypt-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}