What causes "JWK doesn't contain secKey material" in eclipse-vertx/vert.x?

Provide a JWK containing the private key material (d for RSA/EC, k for oct keys)

eclipse-vertx/vert.x · error · IllegalStateException

JWK doesn't contain secKey material

Error message

JWK doesn't contain secKey material

What it means

DigitalSigningAlgorithm.signer() throws IllegalStateException when asked for a signer but the JWK only carries public-key material (privateKey == null). Asymmetric signing requires the private key; a public JWK cannot produce signatures.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/internal/digest/DigitalSigningAlgorithm.java:107

  public boolean canSign() {
    return privateKey != null;
  }

  @Override
  public boolean canVerify() {
    return publicKey != null;
  }

  // TODO : make this compliant
  @Override
  public String name() {
    return alg;
  }

  @Override
  public Signer signer() throws GeneralSecurityException {
    if (privateKey == null) {
      throw new IllegalStateException("JWK doesn't contain secKey material");
    }
    Signature signature;
    try {
      signature = signatureFactory.call();
    } catch (Exception e) {
      throw new GeneralSecurityException(e);
    }
    return payload -> {
      signature.initSign(privateKey);
      signature.update(payload);
      return signature.sign();
    };
  }

  @Override
  public Verifier verifier() throws GeneralSecurityException {
    if (publicKey == null) {
      throw new IllegalStateException("JWK doesn't contain pubKey material");

View on GitHub (pinned to fb308bd8c3)

Solutions

Provide a JWK containing the private key material (d for RSA/EC, k for oct keys)
Use verifier() instead of signer() when you only intend to verify signatures
Load the private key from your keystore/config into the JWK before creating the algorithm

Example fix

// before
JWK pubJwk = JWK.load(publicKeyJson); alg.signer(); // fails
// after
JWK privJwk = JWK.load(privateKeyJson); // includes 'd' field
alg = DigitalSigningAlgorithm.create(privJwk);
Signer signer = alg.signer();

Defensive patterns

Strategy: validation

Validate before calling

if (jwk.isPrivateKey() == false && needsSigning) throw new IllegalStateException("need private key JWK to sign");

Try / catch

try { signer = alg.signer(); } catch (IllegalStateException e) { // JWK is public-only: load signing key instead }

Prevention

Distinguish sign keys from verify keys at config load time (JWKS = public only)
Store the private key material for the issuer, public keys for verifiers
Assert key presence (JWK 'd' / 'k' fields) before building the signing pipeline

When it happens

Trigger: Creating a signing algorithm from a JWK that contains only 'n'/'e' (RSA public) or only the public EC point, then calling signer(); using the verification key where the signing key was expected.

Common situations: Loading a JWKS document (which typically exposes only public keys) and trying to sign tokens with it; confusing the 'verify' key with the 'sign' key; JWK built from a certificate only.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/1053b4a05d4a1e03. Report an issue: GitHub.