quarkusio/quarkus · error · RuntimeException

Failed to generate EC P-256 signing key

Error message

Failed to generate EC P-256 signing key

What it means

The SPIFFE dev service generates an EC P-256 JWK (via smallrye-jwt's EcJwkGenerator) to sign JWT-SVIDs it issues in local dev. If key generation throws for any reason, the dev server start aborts with RuntimeException 'Failed to generate EC P-256 signing key', wrapping the original exception; the cause message is also collected into errorMessages.

Source

Thrown at extensions/spiffe-client/deployment/src/main/java/io/quarkus/spiffe/client/deployment/SpiffeDevServicesProcessor.java:344

            if (endpointSocket != null && endpointSocket.startsWith(UNIX)) {
                String path = endpointSocket.substring(UNIX.length());
                try {
                    Files.deleteIfExists(Path.of(path));
                } catch (IOException e) {
                    LOG.debug("Failed to clean up socket file", e);
                }
            }
        }

        @Override
        public void start() {
            try {
                signingKey = EcJwkGenerator.generateJwk(EllipticCurves.P256);
                signingKey.setKeyId("quarkus-spiffe-dev-svc");
                signingKey.setUse("jwt-svid");
            } catch (Exception e) {
                errorMessages.add("Failed to generate EC P-256 signing key: " + e.getMessage());
                throw new RuntimeException("Failed to generate EC P-256 signing key", e);
            }
            // trying to keep resources minimal:
            vertx = Vertx.vertx(new VertxOptions().setWorkerPoolSize(1).setEventLoopPoolSize(1));

            startGrpcServer();
            startHttpServer();
        }

        private void startGrpcServer() {
            if (transport == Transport.UNIX) {
                Path socketPath;
                try {
                    socketPath = Files.createTempFile(Path.of("/tmp"), "spiffe-", ".sock");
                    Files.delete(socketPath);
                } catch (IOException e) {
                    errorMessages.add("Failed to create temp socket path: " + e.getMessage());
                    throw new RuntimeException("Failed to create temp socket path", e);
                }

View on GitHub (pinned to e1c734241f)

Solutions

1. Read the wrapped cause (`Caused by:`) in the stack trace — the real failure (NoSuchProviderException, NoSuchAlgorithmException, NoClassDefFoundError) tells you which dependency to fix.
2. Align io.smallrye.jwt / jose4j versions with the Quarkus BOM (do not pin them manually).
3. If on a restricted JVM, enable the required JCE provider or use a standard JDK that supports EC P-256.

Example fix

// before: pinned old jwt libs overriding the BOM
<dependency>
  <groupId>org.bitbucket.b_c</groupId>
  <artifactId>jose4j</artifactId>
  <version>0.7.9</version>
</dependency>

// after: let the Quarkus BOM manage the version
<dependency>
  <groupId>org.bitbucket.b_c</groupId>
  <artifactId>jose4j</artifactId>
</dependency>

// Ensure the JWT/EC provider is on the classpath before dev services start:
// ./mvnw dependency:tree -Dincludes=org.bitbucket.b_c:jose4j

try {
    signingKey = EcJwkGenerator.generateJwk(EllipticCurves.P256);
} catch (Exception e) {
    LOG.error("EC P-256 keygen failed; check jose4j/smallrye-jwt versions and JVM crypto policy", e);
    throw e;
}

When it happens

Trigger: start() calls EcJwkGenerator.generateJwk(EllipticCurves.P256) and any underlying exception occurs — typically missing crypto provider classes, a broken/incompatible BouncyCastle or jose4j/smallrye-jwt version on the deployment classpath, or JVM crypto restrictions.

Common situations: Dependency conflicts where an older jose4j or missing EC provider shadows the expected one; running on a hardened/FIPS JVM lacking P-256 EC support; classloader issues in the Quarkus deployment phase after an extension version bump.

Related errors

• The SPIFFE client extension does not support unix transport
• Failed to create temp socket path
• Failed to start SPIFFE gRPC server on ${transport}
• Failed to start SPIFFE HTTP server
• Dev services for ${request.getName()} requires a startable s

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0233e24156f8532b. Report an issue: GitHub.