hashicorp/nomad · error

Unsupported signature algorithm %T; RSA and ECDSA only are s

Error message

Unsupported signature algorithm %T; RSA and ECDSA only are supported.

What it means

getSignatureAlgorithm maps the private key type behind the TLS certificate to a signature-algorithm string ('RSA' or 'ECDSA') used by ParseCiphers. Only *rsa.PrivateKey and *ecdsa.PrivateKey are supported; any other key type (e.g. Ed25519) cannot be matched to cipher suites and triggers this error.

Source

Thrown at helper/tlsutil/config.go:447

	// Default in case this function is called but TLS is not actually configured
	// This is only reached if the TLS certificate is nil
	return []uint16{}, nil
}

// getSignatureAlgorithm returns the signature algorithm for a TLS certificate
// This is determined by examining the type of the certificate's public key,
// as Golang doesn't expose a more straightforward  API which returns this
// type
func getSignatureAlgorithm(tlsCert *tls.Certificate) (signatureAlgorithm, error) {
	privKey := tlsCert.PrivateKey
	switch privKey.(type) {
	case *rsa.PrivateKey:
		return rsaStringRepr, nil
	case *ecdsa.PrivateKey:
		return ecdsaStringRepr, nil
	default:
		return "", fmt.Errorf("Unsupported signature algorithm %T; RSA and ECDSA only are supported.", privKey)
	}
}

// ParseMinVersion parses the specified minimum TLS version for the Nomad agent
func ParseMinVersion(version string) (uint16, error) {
	if version == "" {
		return supportedTLSVersions["tls12"], nil
	}

	vers, ok := supportedTLSVersions[version]
	if !ok {
		return 0, fmt.Errorf("unsupported TLS version %q", version)
	}

	return vers, nil
}

// ShouldReloadRPCConnections compares two TLS Configurations and determines

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Re-issue the certificate with an RSA-2048+ or ECDSA (P-256/P-384) key.
2. Configure the CA/template (e.g. step-ca or Vault PKI) to emit RSA or EC certificates.
3. If the key type cannot change, avoid ParseCiphers' signature check by not restricting tls_cipher_suites.

Example fix

// before
step ca certificate svc.pem svc-key.pem --kty=OKP --curve=Ed25519
// after
step ca certificate svc.pem svc-key.pem --kty=EC --curve=P-256

priv, err := parseKey(certFile, keyFile)
if err != nil { return err }
switch priv.(type) {
case *rsa.PrivateKey, *ecdsa.PrivateKey:
    // ok
default:
    return fmt.Errorf("key type %T unsupported; use RSA or ECDSA", priv)
}

func isSupportedKey(k crypto.Signer) bool {
    switch k.(type) {
    case *rsa.PrivateKey, *ecdsa.PrivateKey:
        return true
    }
    return false
}

When it happens

Trigger: ParseCiphers encounters a certificate whose private key is neither RSA nor ECDSA, e.g. an Ed25519 key, when checking cipher-suite compatibility.

Common situations: Issuing certs with modern Ed25519 keys (common with newer CAs/step-ca/CFSSL defaults) and feeding them to a library that only supports RSA/ECDSA cipher matching.

Related errors

• error generating ECDSA private key: %s
• error marshaling ECDSA private key: %s
• invalid key type: %T
• no PEM-encoded data found
• common name value not provided

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9b7b17629a41f1fb. Report an issue: GitHub.