eclipse-vertx/vert.x · error · IllegalStateException

JWK doesn't contain pubKey material

Error message

JWK doesn't contain pubKey material

What it means

DigitalSigningAlgorithm.verifier() throws IllegalStateException when the JWK lacks public key material (publicKey == null), since signature verification requires the public key. A private-key-only JWK cannot verify signatures.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/internal/digest/DigitalSigningAlgorithm.java:125

      throw new IllegalStateException("JWK doesn't contain secKey material");
    }
    Signature signature;
    try {
      signature = signatureFactory.call();
    } catch (Exception e) {
      throw new GeneralSecurityException(e);
    }
    return payload -> {
      signature.initSign(privateKey);
      signature.update(payload);
      return signature.sign();
    };
  }

  @Override
  public Verifier verifier() throws GeneralSecurityException {
    if (publicKey == null) {
      throw new IllegalStateException("JWK doesn't contain pubKey material");
    }
    Signature sig;
    try {
      sig = signatureFactory.call();
    } catch (Exception e) {
      throw new GeneralSecurityException(e);
    }
    return (signature, payload) -> {
      sig.initVerify(publicKey);
      sig.update(payload);
      if (signature.length < length) {
        // need to adapt the expectation to make the RSA? engine happy
        byte[] normalized = new byte[length];
        System.arraycopy(signature, 0, normalized, 0, signature.length);
        return sig.verify(normalized);
      } else {
        return sig.verify(signature);
      }

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Populate the JWK's public key (derive from the private key or load from JWKS/certificate)
2. Use signer() instead of verifier() if you meant to sign
3. For HMAC-style algorithms use a Mac-based signing algorithm, not the digital (asymmetric) one

Example fix

// before
JWK jwk = JWK.fromPrivateKey(privKey); alg.verifier(); // fails
// after
PublicKey pub = derivePublicKey(privKey);
JWK jwk = JWK.from(privKey, pub);
Verifier v = alg.verifier();

if (jwk.publicKey() == null) throw new IllegalStateException("JWK must contain public key material to verify");

try { verifier = alg.verifier(); } catch (IllegalStateException e) { // public key missing: load JWKS }

When it happens

Trigger: Creating a signing algorithm from a JWK with only private key material (or an oct/secret key used with an asymmetric algorithm) and calling verifier(); a JWK where the public fields (n/e, x/y) were never populated.

Common situations: Storing only private keys in config and expecting verification to work; constructing the JWK from a PrivateKey without deriving the public part; wrong key type for the algorithm (HMAC key used with RS256).

Related errors

• JWK doesn't contain secKey material
• Already a codec registered with name
• Already a default codec registered for class
• Already started
• address not specified

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/2c2efd75b5c54ed1. Report an issue: GitHub.