{"record":{"id":"f97e405dc8ae886d","repo":"grafana/k6","slug":"unsupported-public-key-algorithm","errorCode":null,"errorMessage":"unsupported public key algorithm","messagePattern":"unsupported public key algorithm","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/crypto/x509/x509.go","lineNumber":210,"sourceCode":"\t\tCountry:             first(issuer.Country),\n\t\tStateOrProvinceName: first(issuer.Province),\n\t\tLocalityName:        first(issuer.Locality),\n\t\tOrganizationName:    first(issuer.Organization),\n\t\tNames:               makeRdns(issuer.Names),\n\t}\n}\n\nfunc makePublicKey(parsed any) (PublicKey, error) {\n\tvar algorithm string\n\tswitch parsed.(type) {\n\tcase *dsa.PublicKey:\n\t\talgorithm = \"DSA\"\n\tcase *ecdsa.PublicKey:\n\t\talgorithm = \"ECDSA\"\n\tcase *rsa.PublicKey:\n\t\talgorithm = \"RSA\"\n\tdefault:\n\t\terr := errors.New(\"unsupported public key algorithm\")\n\t\treturn PublicKey{}, err\n\t}\n\treturn PublicKey{\n\t\tAlgorithm: algorithm,\n\t\tKey:       parsed,\n\t}, nil\n}\n\nfunc first(values []string) string {\n\tif len(values) > 0 {\n\t\treturn values[0]\n\t}\n\treturn \"\"\n}\n\nfunc iso8601(value time.Time) string {\n\treturn value.Format(time.RFC3339)\n}","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/crypto/x509/x509.go#L192-L228","documentation":"k6/crypto/x509.parse() converts a parsed X.509 certificate into its JS representation. makePublicKey (x509.go:200-216) only understands DSA, ECDSA and RSA public keys; any other key type falls to the default branch and yields 'unsupported public key algorithm'.","triggerScenarios":"Calling x509.parse() on a PEM certificate whose SubjectPublicKeyInfo uses Ed25519, Ed448, or another algorithm outside the DSA/ECDSA/RSA trio — increasingly common with modern ACME-issued certificates.","commonSituations":"Parsing contemporary TLS certificates (e.g. Let's Encrypt Ed25519); internal PKIs migrating to Ed25519; feeding raw key PEMs instead of certificates; older k6 builds encountering newer key types.","solutions":["Parse an RSA- or ECDSA-based certificate if you need the full parsed output","Request ECDSA/RSA certificates from your CA for endpoints whose certs the test must inspect","Update k6 — newer builds may extend the supported algorithm set","Catch the error and fall back to fields not requiring the public key (subject, issuer, validity)"],"exampleFix":"// before\nimport { parse } from 'k6/crypto/x509';\nconst cert = parse(pem); // Ed25519 cert -> unsupported\n\n// after\nimport { parse } from 'k6/crypto/x509';\nlet cert;\ntry {\n  cert = parse(pem);\n} catch (e) {\n  console.warn('public key algorithm not supported; using cert metadata only');\n}","handlingStrategy":"try-catch","validationCode":"// Pre-check the key algorithm out-of-band when certs are fixed at authoring time:\n// openssl x509 -in cert.pem -noout -text | grep 'Public Key Algorithm'\n// Ensure it reads rsaEncryption or id-ecPublicKey before using x509.parse().","typeGuard":null,"tryCatchPattern":"try {\n  const cert = parse(pem);\n} catch (e) {\n  if (String(e.message).includes('unsupported public key algorithm')) {\n    // Ed25519/Ed448 key: proceed without parsed public-key fields\n  } else { throw e; }\n}","preventionTips":["Prefer RSA/ECDSA certificates for endpoints your tests inspect","Pin known-good fixtures instead of parsing live modern certs","Track k6 releases for expanded key-algorithm support"],"tags":["x509","crypto","certificate","k6"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}