quarkusio/quarkus · error · RuntimeException

Algorithm not supported:

Error message

Algorithm not supported: 

What it means

GenerateKey.call validates the requested key algorithm for `quarkus generate jwt-key` (or similar JWT key generation). Only 'RSA' (default) and 'EC' are accepted; any other value throws a plain RuntimeException naming the unsupported algorithm.

Source

Thrown at devtools/cli/src/main/java/io/quarkus/cli/jwt/GenerateKey.java:41

    @Option(names = { "-f", "--force" }, description = "Overwrite existing private/public keys")
    boolean force;

    @Option(names = { "-s",
            "--size" }, description = "Key size (Defaults to 2048 for RSA, 256 for Elliptic Curve (EC). EC supports 256, 384, or 512)")
    int size;

    @Option(names = { "-a", "--algo" }, description = "Key algorithm: RSA or EC (Defaults to RSA)")
    String algo;

    @Override
    public Integer call() throws Exception {
        if (algo != null) {
            if (algo.equalsIgnoreCase("RSA")) {
                algo = "RSA";
            } else if (algo.equalsIgnoreCase("EC")) {
                algo = "EC";
            } else {
                throw new RuntimeException("Algorithm not supported: " + algo);
            }
        } else {
            algo = "RSA";
        }
        if (algo.equals("RSA")) {
            if (size == 0) {
                size = 2048;
            }
        } else {
            if (size == 0) {
                size = 256;
            }
        }

        Path resourcesFolder = projectRoot().resolve("src/main/resources");
        if (!Files.exists(resourcesFolder))
            Files.createDirectories(resourcesFolder);
        Path privateKey = resourcesFolder.resolve("privateKey.pem");

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass --algorithm RSA or --algorithm EC (case-insensitive).
2. Omit the algorithm option entirely to get the RSA default.
3. If you need a different key type, generate it with the JDK `keytool` or OpenSSL and register the resulting JWKS manually.

Example fix

// before
quarkus generate jwt-key --algorithm RS256
// after
quarkus generate jwt-key --algorithm RSA

Set<String> SUPPORTED = Set.of("RSA", "EC");
if (algo != null && !SUPPORTED.contains(algo.toUpperCase(Locale.ROOT))) {
    throw new IllegalArgumentException("Use RSA or EC, got: " + algo);
}

public static boolean isSupportedKeyAlgorithm(String algo) {
    return "RSA".equalsIgnoreCase(algo) || "EC".equalsIgnoreCase(algo);
}

try {
    generateKey(algo, size);
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Algorithm not supported")) {
        log.warn("Falling back to RSA");
        generateKey("RSA", size);
    } else throw e;
}

When it happens

Trigger: Calling the key-generation CLI with an --algorithm (algo) option value that is not 'RSA' or 'EC' (case-insensitive), e.g. 'Ed25519', 'HMAC', 'rs256', 'DSA'.

Common situations: Confusing JWS signature algorithm names (RS256/ES256) with key-pair algorithms (RSA/EC); expecting EdDSA support that the tool does not implement; typo like 'rsa ' with whitespace (equalsIgnoreCase still fails on non-letter chars).

Related errors

• More than one @QuarkusMain method found with name '${name}':
• Build metrics file cannot be read:
• Build report file cannot be written to:
• The specified %s identifier (%s) contains invalid characters
• Unknown plugin type!

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7ba39732842a0e62. Report an issue: GitHub.