What causes "failed to generate rsa key: %w" in hashicorp/nomad?

failed to generate rsa key: %w

Error message

failed to generate rsa key: %w

What it means

Generating the 2048-bit RSA key used to sign workload identity JWTs failed; the wrapped crypto error from rsa.GenerateKey typically indicates an entropy or system-level failure.

Source

Thrown at nomad/structs/keyring.go:75

	meta.Algorithm = algorithm

	rootKey := &UnwrappedRootKey{
		Meta: meta,
	}

	switch algorithm {
	case EncryptionAlgorithmAES256GCM:
		key, err := crypto.Bytes(32)
		if err != nil {
			return nil, fmt.Errorf("failed to generate root key: %w", err)
		}
		rootKey.Key = key
	}

	// Generate RSA key for signing workload identity JWTs with RS256.
	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, fmt.Errorf("failed to generate rsa key: %w", err)
	}

	rootKey.RSAKey = x509.MarshalPKCS1PrivateKey(rsaPrivateKey)

	return rootKey, nil
}

func (k *UnwrappedRootKey) Copy() *UnwrappedRootKey {
	return &UnwrappedRootKey{
		Meta:   k.Meta.Copy(),
		Key:    slices.Clone(k.Key),
		RSAKey: slices.Clone(k.RSAKey),
	}
}

// MakeActive returns a copy of the RootKey with the meta state set to active
func (k *UnwrappedRootKey) MakeActive() *UnwrappedRootKey {
	meta := k.Meta.Copy()

View on GitHub (pinned to 482b49bf1a)

Solutions

Retry key generation
Ensure the system entropy source (/dev/urandom) is available and healthy
Check for OS-level crypto library issues in logs

Defensive patterns

Strategy: retry

Validate before calling

// probe crypto/rand before keyring operations
if _, err := crand.Read(make([]byte, 16)); err != nil {
  return fmt.Errorf("crypto/rand broken in this environment: %w", err)
}

Try / catch

rootKey, err := structs.NewUnwrappedRootKey(alg)
if err != nil && strings.Contains(err.Error(), "failed to generate rsa key") {
  // fix rand.Reader / entropy source, then retry
}

Prevention

Verify crypto/rand works in restricted CI images
Do not disable getrandom in sandbox policies
Surface wrapped errors (%w) with errors.As for diagnosis

When it happens

Trigger: Calling NewUnwrappedRootKey when rsa.GenerateKey(rand.Reader, 2048) returns an error, almost always due to rand.Reader (crypto/rand) failing to supply entropy.

Common situations: Same entropy problems as AES key generation: blocked getrandom syscall, sandboxed CI, kernel entropy issues; very rare since RSA generation only needs the same rand.Reader.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4d82c9f2beb837c4. Report an issue: GitHub.