{"record":{"id":"fbcc4f9b662261a9","repo":"caddyserver/caddy","slug":"unrecognized-public-key-algorithm-s-expected-on","errorCode":null,"errorMessage":"unrecognized public key algorithm: %s (expected one of %v)","messagePattern":"unrecognized public key algorithm: (.+?) \\(expected one of (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":1056,"sourceCode":"\t\treturn fmt.Errorf(\"can't parse the given certificate: %s\", err.Error())\n\t}\n\n\tif slices.ContainsFunc(l.trustedLeafCerts, remoteLeafCert.Equal) {\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"client leaf certificate failed validation\")\n}\n\n// PublicKeyAlgorithm is a JSON-unmarshalable wrapper type.\ntype PublicKeyAlgorithm x509.PublicKeyAlgorithm\n\n// UnmarshalJSON satisfies json.Unmarshaler.\nfunc (a *PublicKeyAlgorithm) UnmarshalJSON(b []byte) error {\n\talgoStr := strings.ToLower(strings.Trim(string(b), `\"`))\n\talgo, ok := publicKeyAlgorithms[algoStr]\n\tif !ok {\n\t\treturn fmt.Errorf(\"unrecognized public key algorithm: %s (expected one of %v)\",\n\t\t\talgoStr, publicKeyAlgorithms)\n\t}\n\t*a = PublicKeyAlgorithm(algo)\n\treturn nil\n}\n\n// ConnectionMatcher is a type which matches TLS handshakes.\ntype ConnectionMatcher interface {\n\tMatch(*tls.ClientHelloInfo) bool\n}\n\n// LeafCertificateLoader is a type that loads the trusted leaf certificates\n// for the tls.leaf_cert_loader modules\ntype LeafCertificateLoader interface {\n\tLoadLeafCertificates() ([]*x509.Certificate, error)\n}\n\n// ClientCertificateVerifier is a type which verifies client certificates.","sourceCodeStart":1038,"sourceCodeEnd":1074,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L1038-L1074","documentation":"PublicKeyAlgorithm.UnmarshalJSON maps a string to an x509.PublicKeyAlgorithm for TLS verification settings (e.g. verifiers' public_key_algorithms lists). The string (lowercased, quotes trimmed) must be a key of the internal map — the standard algorithm names such as 'rsa', 'ed25519', 'ecdsa', 'dsa' variants; anything else errors with the accepted list included in the message.","triggerScenarios":"Writing \"public_key_algorithms\": [\"RS256\"] or [\"RSA-2048\"] or [\"P256\"] in JSON verification config instead of the Go algorithm names like \"rsa\" or \"ecdsa\".","commonSituations":"Confusing JWS/JOSE algorithm identifiers (RS256, ES256) or curve names (P-256) with x509 public key algorithm names; uppercase spellings are tolerated via ToLower but hyphenated or prefixed names are not.","solutions":["Use the algorithm names from the error message's expected list (it prints the valid map) — typically: rsa, dsa, ecdsa, ed25519","Drop JOSE-style names: RS256->rsa, ES256/ECDSA->ecdsa, Ed25519->ed25519","Run caddy validate on the JSON to fail fast before reload"],"exampleFix":"// before\n\"verifier\": {\"module\": \"leaf\", \"public_key_algorithms\": [\"RS256\"]}\n\n// after\n\"verifier\": {\"module\": \"leaf\", \"public_key_algorithms\": [\"rsa\"]}","handlingStrategy":"validation","validationCode":"var validPKAlgorithms = map[string]bool{\n\t\"rsa\": true, \"dsa\": true, \"ecdsa\": true, \"ed25519\": true,\n}\nfunc validateAlgoList(algos []string) error {\n\tfor _, a := range algos {\n\t\tif !validPKAlgorithms[strings.ToLower(a)] {\n\t\t\treturn fmt.Errorf(\"public key algorithm %q not recognized; use x509 algorithm names (rsa, ecdsa, ed25519...)\", a)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":"func isX509AlgorithmName(s string) bool {\n\t_, ok := map[string]struct{}{\"rsa\": {}, \"dsa\": {}, \"ecdsa\": {}, \"ed25519\": {}}[strings.ToLower(s)]\n\treturn ok\n}","tryCatchPattern":null,"preventionTips":["Never use JOSE/JWT identifiers (RS256, ES256) in x509 algorithm lists","The error message prints the valid map — read it and copy a key exactly","Centralize verification config in a tested template"],"tags":["tls","json","validation","x509"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}