grafana/k6 · error

unsupported public key algorithm

Error message

unsupported public key algorithm

What it means

k6/crypto/x509.parse() converts a parsed X.509 certificate into its JS representation. makePublicKey (x509.go:200-216) only understands DSA, ECDSA and RSA public keys; any other key type falls to the default branch and yields 'unsupported public key algorithm'.

Source

Thrown at internal/js/modules/k6/crypto/x509/x509.go:210

		Country:             first(issuer.Country),
		StateOrProvinceName: first(issuer.Province),
		LocalityName:        first(issuer.Locality),
		OrganizationName:    first(issuer.Organization),
		Names:               makeRdns(issuer.Names),
	}
}

func makePublicKey(parsed any) (PublicKey, error) {
	var algorithm string
	switch parsed.(type) {
	case *dsa.PublicKey:
		algorithm = "DSA"
	case *ecdsa.PublicKey:
		algorithm = "ECDSA"
	case *rsa.PublicKey:
		algorithm = "RSA"
	default:
		err := errors.New("unsupported public key algorithm")
		return PublicKey{}, err
	}
	return PublicKey{
		Algorithm: algorithm,
		Key:       parsed,
	}, nil
}

func first(values []string) string {
	if len(values) > 0 {
		return values[0]
	}
	return ""
}

func iso8601(value time.Time) string {
	return value.Format(time.RFC3339)
}

View on GitHub (pinned to 93accf6570)

Solutions

1. Parse an RSA- or ECDSA-based certificate if you need the full parsed output
2. Request ECDSA/RSA certificates from your CA for endpoints whose certs the test must inspect
3. Update k6 — newer builds may extend the supported algorithm set
4. Catch the error and fall back to fields not requiring the public key (subject, issuer, validity)

Example fix

// before
import { parse } from 'k6/crypto/x509';
const cert = parse(pem); // Ed25519 cert -> unsupported

// after
import { parse } from 'k6/crypto/x509';
let cert;
try {
  cert = parse(pem);
} catch (e) {
  console.warn('public key algorithm not supported; using cert metadata only');
}

// Pre-check the key algorithm out-of-band when certs are fixed at authoring time:
// openssl x509 -in cert.pem -noout -text | grep 'Public Key Algorithm'
// Ensure it reads rsaEncryption or id-ecPublicKey before using x509.parse().

try {
  const cert = parse(pem);
} catch (e) {
  if (String(e.message).includes('unsupported public key algorithm')) {
    // Ed25519/Ed448 key: proceed without parsed public-key fields
  } else { throw e; }
}

When it happens

Trigger: Calling x509.parse() on a PEM certificate whose SubjectPublicKeyInfo uses Ed25519, Ed448, or another algorithm outside the DSA/ECDSA/RSA trio — increasingly common with modern ACME-issued certificates.

Common situations: Parsing contemporary TLS certificates (e.g. Let's Encrypt Ed25519); internal PKIs migrating to Ed25519; feeding raw key PEMs instead of certificates; older k6 builds encountering newer key types.

Related errors

• invalid size
• failed to append root certificate to the pool
• new SharedArray must be called in the init context
• empty name provided to SharedArray's constructor
• SharedArray constructor does not support async functions as

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/f97e405dc8ae886d. Report an issue: GitHub.