eclipse-vertx/vert.x · error · NoSuchAlgorithmException

${certificate.getSigAlgName()}

Error message

${certificate.getSigAlgName()}

What it means

SigningAlgorithm.create() derives the expected signature length from the certificate's signature algorithm name; when the certificate's SigAlgName is not one of the recognized values (e.g. unknown SHA/ECDSA/RSA variant), it throws NoSuchAlgorithmException carrying that name as the message.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/internal/digest/SigningAlgorithm.java:69

      PrivateKey privateKey = privateKeyEntry.getPrivateKey();
      PublicKey publicKey = certificate.getPublicKey();
      Callable<Signature> signatureFactory = () -> Signature.getInstance(certificate.getSigAlgName());
      int len;
      if (publicKey instanceof RSAKey) {
        len = ((RSAKey) publicKey).getModulus().bitLength() + 7 >> 3;
      } else {
        switch (certificate.getSigAlgName()) {
          case "SHA256withECDSA":
            len = 64;
            break;
          case "SHA384withECDSA":
            len = 96;
            break;
          case "SHA512withECDSA":
            len = 132;
            break;
          default:
            throw new NoSuchAlgorithmException(certificate.getSigAlgName());
        }
      }
      return DigitalSigningAlgorithm.createPubKeySigningAlgorithm(certificate.getSigAlgName(), privateKey, publicKey, "" + certificate.hashCode(), signatureFactory, len);
    } else {
      throw new UnsupportedOperationException();
    }
  }

  /**
   * @return a thread safe version of this instance
   */
  public SigningAlgorithm safe() {
    // Make this configurable through system properties ???
//    return new ThreadSafeSigningAlgorithm(this);
    return new ThreadLocalSigningAlgorithm(this);
  }

  /**

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Re-issue/obtain a certificate signed with a supported algorithm (SHA256withRSA, SHA256withECDSA, etc.)
2. Extend the mapping by handling the algorithm name explicitly via createPubKeySigningAlgorithm with the correct length
3. Validate the certificate's algorithm before feeding it to SigningAlgorithm.create()

Example fix

// before
SigningAlgorithm.create(certificate, priv, pub); // throws for unknown alg
// after
String algName = certificate.getSigAlgName();
if (!SUPPORTED.contains(algName)) {
  throw new IllegalArgumentException("Unsupported cert alg: " + algName);
}
SigningAlgorithm.create(certificate, priv, pub);

Set.of("SHA256withRSA","SHA384withRSA","SHA512withRSA","SHA256withECDSA","SHA384withECDSA","SHA512withECDSA").contains(certificate.getSigAlgName())

try { alg = SigningAlgorithm.create(cert, priv, pub); } catch (NoSuchAlgorithmException e) { // unsupported cert signature alg: reissue or map manually }

When it happens

Trigger: Creating a signing algorithm from an X.509 certificate whose getSigAlgName() is not in the supported switch (e.g. exotic OID, SM3withRSA, SHA3 variants, or a garbled name), hitting the default branch.

Common situations: Certificates issued with uncommon or legacy signature algorithms; providers reporting unusual algorithm names; parsing certificates from non-standard CAs; JDK lacking support for the certificate's algorithm family.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Certificate revoked
• Missing -----BEGIN CERTIFICATE----- delimiter
• Cannot determine EC parameter spec for curve name/OID

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/b505c3a386c64ef6. Report an issue: GitHub.