ruby/ruby · error · Gem::Security::Exception

incorrect signing key for signing

Error message

incorrect signing key for signing

What it means

Inside certificate creation (Gem::Security create_cert path used by gem cert --sign), RubyGems executes signed.sign(signing_key, Gem::Security::DIGEST_NAME) with the fixed SHA-256 digest and rescues OpenSSL::PKey::PKeyError/ArgumentError into this error. It fires when the key cannot sign with SHA-256: a key that does not match the signing certificate, or a key type incompatible with the digest (DSA keys cannot sign SHA-256).

Source

Thrown at lib/rubygems/security.rb:568

    end

    extensions = extensions.merge "subjectAltName" => alt_name.value if
      alt_name

    issuer_alt_name = signing_cert.extensions.find do |extension|
      extension.oid == "subjectAltName"
    end

    extensions = extensions.merge "issuerAltName" => issuer_alt_name.value if
      issuer_alt_name

    signed = create_cert signee_subject, signee_key, age, extensions, serial
    signed.issuer = signing_cert.subject

    begin
      signed.sign signing_key, Gem::Security::DIGEST_NAME
    rescue OpenSSL::PKey::PKeyError, ArgumentError
      raise Gem::Security::Exception,
        "incorrect signing key for signing"
    end
  end

  ##
  # Returns a Gem::Security::TrustDir which wraps the directory where trusted
  # certificates live.

  def self.trust_dir
    return @trust_dir if @trust_dir

    dir = File.join Gem.user_home, ".gem", "trust"

    @trust_dir ||= Gem::Security::TrustDir.new dir
  end

  ##
  # Enumerates the trusted certificates via Gem::Security::TrustDir.

View on GitHub (pinned to 0e5b888e1c)

Solutions

1. Pass the exact private key that pairs with the signing certificate (-K / signing_key); verify with cert.check_private_key(key)
2. Use an RSA or EC key pair — DSA keys cannot be combined with the SHA-256 digest this code path fixes
3. Sanity-check the key loads as a private key: OpenSSL::PKey.read(File.read(key_path)) before signing

Example fix

# before
$ gem cert --sign child.pem -K dsa_ca_key.pem
#=> incorrect signing key for signing

# after: sign with the RSA private key matching the CA cert
$ gem cert --sign child.pem -K rsa_ca_key.pem

cert = OpenSSL::X509::Certificate.new(File.read(signing_cert_path))
key  = OpenSSL::PKey.read(File.read(key_path))
raise "key does not match signing cert" unless cert.check_private_key(key)
raise "DSA key cannot sign with SHA-256" if key.is_a?(OpenSSL::PKey::DSA)

When it happens

Trigger: gem cert --sign cert.pem -K key.pem where the key is the wrong pair or a DSA key while DIGEST_NAME is SHA256; programmatic create_cert calls with mismatched signing_key/signing_cert; passing an encrypted key that failed to decrypt into a usable object.

Common situations: Signing child certificates with a CA key of the wrong type; mixed RSA/DSA assets from legacy setups; scripts that load the public key instead of the private key.

Related errors

• incorrect signing key for re-signing #{expired_certificate.s
• no certs provided
• #{algorithm} algorithm not found. RSA, DSA, and EC algorithm
• #{subject} is not self-signed, contact #{issuer} to obtain a
• Peer verification enabled, but no certificate received.

AI-assisted analysis of ruby/ruby@0e5b888e1c (2026-08-21). Data as JSON: /api/errors/f0bd7b6d36612826. Report an issue: GitHub.