What causes "error validating %s: %w" in hashicorp/nomad?

Re-generate a fresh RSA key pair: `openssl genrsa -out client.key 2048 && openssl rsa -in client.key -pubout -out client.pub`.

hashicorp/nomad · error

error validating %s: %w

Error message

error validating %s: %w

What it means

The PEM parsed successfully into an RSA private key, but key.Validate() rejected it — the key's internal parameters are inconsistent (e.g. primes/exponent don't match, precomputation invalid). This indicates a corrupted or malformed key rather than a formatting problem.

Source

Thrown at lib/auth/oidc/client_assertion.go:145

		if err != nil {
			return nil, fmt.Errorf("error reading %s: %w", source, err)
		}
	}
	// or pem string
	if k.PemKey != "" {
		source = "PemKey"
		bts = []byte(k.PemKey)
	}

	// ensure newlines around pem header/footer
	bts = newlineHeaders(bts)

	key, err = gojwt.ParseRSAPrivateKeyFromPEM(bts)
	if err != nil {
		return nil, fmt.Errorf("error parsing %s: %w", source, err)
	}
	if err := key.Validate(); err != nil {
		return nil, fmt.Errorf("error validating %s: %w", source, err)
	}
	return key, nil
}

// getCassCert parses the structs.OIDCClientAssertionKey PemCertFile
// or PemCert, depending on which is set.
func getCassCert(k *structs.OIDCClientAssertionKey) (*x509.Certificate, error) {
	var bts []byte
	var err error
	var source string // for informative error messages

	// pem file on disk
	if k.PemCertFile != "" {
		source = "PemCertFile"
		bts, err = os.ReadFile(k.PemCertFile)
		if err != nil {
			return nil, fmt.Errorf("error reading %s: %w", source, err)
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

Re-generate a fresh RSA key pair: `openssl genrsa -out client.key 2048 && openssl rsa -in client.key -pubout -out client.pub`.
Verify the existing key with `openssl rsa -in key.pem -check -noout` and replace it if invalid.
Re-provision the key from the secret store rather than re-using the corrupted copy.

Example fix

// before: corrupted key reused
PemKeyFile: "/secrets/damaged-client.key"
// after: freshly generated and validated key
PemKeyFile: "/secrets/client.key" // openssl rsa -check passed

Defensive patterns

Strategy: validation

Validate before calling

func precheckKeyMaterial(bts []byte) error {
  key, err := gojwt.ParseRSAPrivateKeyFromPEM(bts)
  if err != nil { return err }
  if err := key.Validate(); err != nil {
    return fmt.Errorf("key math invalid, regenerate: %w", err)
  }
  return nil
}

Try / catch

key, err := getCassPrivateKey(k)
if err != nil && strings.Contains(err.Error(), "error validating") {
  return fmt.Errorf("key corrupted; regenerate and re-provision: %w", err)
}

Prevention

Regenerate any key that fails `openssl rsa -check`.
Provision keys from a secret store rather than copying between environments.
Avoid hand-editing PEM files; re-export with openssl instead.

When it happens

Trigger: BuildClientAssertionJWT → getCassPrivateKey after successful parse, when rsa.PrivateKey.Validate() fails due to mathematically inconsistent key material (usually corruption or tampering).

Common situations: Key file damaged in transit or by a templating tool; hand-edited PEM; key generated by a broken tooling; truncated/partial paste that still parses in degraded form.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4e9e4631584c8dd3. Report an issue: GitHub.