gchq/CyberChef · error · OperationError

Unsupported public key type

Error message

Unsupported public key type

What it means

After loading the PEM, PubKeyFromCert calls jsrsasign's cert.getPublicKey(); if that throws, the op reports 'Unsupported public key type'. getPublicKey throws for key algorithms/jsrsasign does not recognize or cannot parse (for example some EdDSA/Ed25519, exotic curves, or a malformed SubjectPublicKeyInfo). The catch is intentionally broad, so the original jsrsasign error is not surfaced.

Source

Thrown at src/core/operations/PubKeyFromCert.mjs:57

        let match;
        const regex = /-----BEGIN CERTIFICATE-----/g;
        while ((match = regex.exec(input)) !== null) {
            // find corresponding end tag
            const indexBase64 = match.index + match[0].length;
            const footer = "-----END CERTIFICATE-----";
            const indexFooter = input.indexOf(footer, indexBase64);
            if (indexFooter === -1) {
                throw new OperationError(`PEM footer '${footer}' not found`);
            }

            const certPem = input.substring(match.index, indexFooter + footer.length);
            const cert = new r.X509();
            cert.readCertPEM(certPem);
            let pubKey;
            try {
                pubKey = cert.getPublicKey();
            } catch {
                throw new OperationError("Unsupported public key type");
            }
            const pubKeyPem = r.KEYUTIL.getPEM(pubKey);

            // PEM ends with '\n', so a new key always starts on a new line
            output += pubKeyPem;
        }
        return output;
    }
}

export default PubKeyFromCert;

View on GitHub (pinned to 4290ea7539)

Solutions

  1. Extract the key with openssl instead: 'openssl x509 -in cert.pem -pubkey -noout'.
  2. Upgrade CyberChef (and thus the bundled jsrsasign) for broader algorithm support.
  3. Confirm the cert is well-formed with 'openssl x509 -in cert.pem -noout -text'.
  4. If the algorithm is supported by a newer jsrsasign, report it so the dependency can be updated.

Example fix

// before: cert with unsupported key type
run(ed25519CertPem, []);

// after: extract with openssl externally
// openssl x509 -in cert.pem -pubkey -noout > pubkey.pem
Defensive patterns

Strategy: try-catch

Validate before calling

// No general pre-check: getPublicKey() failure depends on jsrsasign's algorithm support.
// Probe the key algorithm OID first if you have an ASN.1 parser, else fall back to try/catch.

Type guard

function isLikelySupportedKeyAlgorithm(certPem) {
  // Best-effort: returns false for known-unsupported OIDs like Ed25519 (1.3.101.112)
  return !/1\.3\.101\.11[0-9]/.test(certPem);
}

Try / catch

try {
  return pubKeyFromCert.run(certPem, []);
} catch (e) {
  if (e.message === "Unsupported public key type") {
    // fall back to openssl: openssl x509 -in cert.pem -pubkey -noout
  }
  throw e;
}

Prevention

When it happens

Trigger: A certificate carrying a public key algorithm the bundled jsrsasign does not support (e.g. Ed25519/Ed448 on older jsrsasign); a malformed SPKI; a certificate with an unknown curve OID; a corrupted cert that still parses at the SEQUENCE level.

Common situations: Modern certificates using algorithms jsrsasign lags on; cross-version certificate suites; hand-crafted or damaged certs; using a CyberChef build with an older jsrsasign.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/bf015d0d59866384. Report an issue: GitHub.