hashicorp/nomad · error

unknown algorithm: %q

Error message

unknown algorithm: %q

What it means

This error means the keyring public-key parser received an algorithm string it does not recognize. The switch over the algorithm only handles Ed25519 and RS256; anything else falls to the default branch. It indicates a configuration value or stored key metadata naming an unsupported/unexpected signing algorithm.

Source

Thrown at nomad/structs/keyring.go:587

// retrieve the public key as functions such as go-jose's Claims(pubKey,
// claims) inspect pubKey's concrete type.
func (pubKey *KeyringPublicKey) GetPublicKey() (any, error) {
	switch alg := pubKey.Algorithm; alg {

	case PubKeyAlgEdDSA:
		// Convert public key bytes to an ed25519 public key
		return ed25519.PublicKey(pubKey.PublicKey), nil

	case PubKeyAlgRS256:
		// PEM -> rsa.PublickKey
		rsaPubKey, err := x509.ParsePKCS1PublicKey(pubKey.PublicKey)
		if err != nil {
			return nil, fmt.Errorf("error parsing %s public key: %w", alg, err)
		}
		return rsaPubKey, nil

	default:
		return nil, fmt.Errorf("unknown algorithm: %q", alg)
	}
}

// KeyringGetConfigResponse is the response for Keyring.GetConfig RPCs.
type KeyringGetConfigResponse struct {
	OIDCDiscovery *OIDCDiscoveryConfig
}

// OIDCDiscoveryConfig represents the response to OIDC Discovery requests
// usually at: /.well-known/openid-configuration
//
// Only the fields Nomad uses are implemented since many fields in the
// specification are not relevant to Nomad's use case:
// https://openid.net/specs/openid-connect-discovery-1_0.html
type OIDCDiscoveryConfig struct {
	Issuer        string   `json:"issuer"`
	JWKS          string   `json:"jwks_uri"`
	IDTokenAlgs   []string `json:"id_token_signing_alg_values_supported"`

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change the configured algorithm to a supported value: RS256 or Ed25519
2. Check for typos/case mismatches in the algorithm string and correct it
3. If the algorithm is from a newer Nomad release, upgrade the server to a version that supports it
4. Check the wrapped error source: whether alg comes from key metadata (stale keyring entries) or from config

Example fix

// before
keyring_config { signing_algorithm = "ES256" }
// after
keyring_config { signing_algorithm = "RS256" }

func validateKeyAlg(alg string) error {
	switch alg {
	case "RS256", "Ed25519":
		return nil
	default:
		return fmt.Errorf("unsupported key algorithm %q: must be RS256 or Ed25519", alg)
	}
}

if err := validateKeyAlg(cfg.SigningAlgorithm); err != nil {
	// fail fast at config load, before calling keyring APIs
	return err
}

When it happens

Trigger: Passing an algorithm label other than Ed25519 or RS256 (e.g. ES256, HS256, a misspelled value like "rs256" if case is not normalized upstream) into the keyring public-key parsing path used by workload identity/OIDC key configuration.

Common situations: Typos in signing_algorithm config; using an algorithm supported by a newer Nomad version on an older server binary; keys stored by a newer version read by an older one; mixing up HMAC (HS256) names with asymmetric key algorithms.

Related errors

• Invalid key: %s
• only one server.keyring can be active in Nomad Community Edi
• unknown keyring provider: %q
• no CNI network config found
• dynamic workload users disabled

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/db50598534e79c13. Report an issue: GitHub.