hashicorp/nomad · error

error parsing %s: %w

Error message

error parsing %s: %w

What it means

getCassPrivateKey could not parse the PEM bytes into an RSA private key; gojwt.ParseRSAPrivateKeyFromPEM rejected the content (wrapped as %w). The source string tells whether the bytes came from PemKeyFile or PemKey.

Source

Thrown at lib/auth/oidc/client_assertion.go:142

	if k.PemKeyFile != "" {
		source = "PemKeyFile"
		bts, err = os.ReadFile(k.PemKeyFile)
		if err != nil {
			return nil, fmt.Errorf("error reading %s: %w", source, err)
		}
	}
	// or pem string
	if k.PemKey != "" {
		source = "PemKey"
		bts = []byte(k.PemKey)
	}

	// ensure newlines around pem header/footer
	bts = newlineHeaders(bts)

	key, err = gojwt.ParseRSAPrivateKeyFromPEM(bts)
	if err != nil {
		return nil, fmt.Errorf("error parsing %s: %w", source, err)
	}
	if err := key.Validate(); err != nil {
		return nil, fmt.Errorf("error validating %s: %w", source, err)
	}
	return key, nil
}

// getCassCert parses the structs.OIDCClientAssertionKey PemCertFile
// or PemCert, depending on which is set.
func getCassCert(k *structs.OIDCClientAssertionKey) (*x509.Certificate, error) {
	var bts []byte
	var err error
	var source string // for informative error messages

	// pem file on disk
	if k.PemCertFile != "" {
		source = "PemCertFile"
		bts, err = os.ReadFile(k.PemCertFile)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Confirm the key is an RSA private key: `openssl rsa -in key.pem -check`; generate RSA if needed with `openssl genrsa 2048`.
2. Ensure the PEM has intact `-----BEGIN/END RSA PRIVATE KEY-----` (or PRIVATE KEY) headers and full base64 body.
3. Verify the file contains the key, not the certificate or public key; if EC key, reissue as RSA.

Example fix

// before: EC key
PemKey: "-----BEGIN EC PRIVATE KEY-----\n..."
// after: RSA key
PemKey: "-----BEGIN RSA PRIVATE KEY-----\n..."

func validateRSAPrivateKeyPEM(pemStr string) error {
  key, err := gojwt.ParseRSAPrivateKeyFromPEM([]byte(pemStr))
  if err != nil { return fmt.Errorf("not a valid RSA private key PEM: %w", err) }
  return key.Validate()
}
// run against PemKey/PemKeyFile content before configuring

func isRSAPrivateKeyPEM(s string) bool {
  blk, _ := pem.Decode([]byte(s))
  return blk != nil && strings.Contains(blk.Type, "PRIVATE KEY")
}

key, err := getCassPrivateKey(k)
if err != nil && strings.Contains(err.Error(), "error parsing") {
  return fmt.Errorf("configured key is not an RSA private key PEM: %w", err)
}

When it happens

Trigger: BuildClientAssertionJWT → getCassPrivateKey after successfully reading the key bytes, when the content is not a valid PEM RSA private key (wrong key type, ECDSA key, corrupt base64, truncated file).

Common situations: EC or Ed25519 key supplied where RSA is required; certificate pasted instead of the key; key file truncated by a bad copy-paste; PKCS#8 vs PKCS#1 edge cases in older parsers.

Related errors

• error validating %s: %w
• failed to decode %s PEM block
• require only one of PemKey or PemKeyFile
• missing PemCert, PemCertFile, or KeyID
• require only one of PemCert, PemCertFile, or KeyID

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6da8b62f9a609d41. Report an issue: GitHub.