shadow1ng/fscan · error

invalid public key type

Error message

invalid public key type

What it means

Raised in SocketLayer.TlsPubKey when the server certificate's public key is present but is not *rsa.PublicKey (e.g. an ECDSA/Ed25519 certificate), so it cannot be ASN.1-marshaled for RDP CredSSP key derivation, which expects RSA.

Source

Thrown at libs/grdp/core/socket.go:78

	return s.tlsConn.Handshake()
}

type PublicKey struct {
	N *big.Int `asn1:"explicit,tag:0"` // modulus
	E int      `asn1:"explicit,tag:1"` // public exponent
}

func (s *SocketLayer) TlsPubKey() ([]byte, error) {
	if s.tlsConn == nil {
		return nil, errors.New("TLS conn does not exist")
	}
	certs := s.tlsConn.ConnectionState().PeerCertificates
	if len(certs) == 0 {
		return nil, errors.New("no peer certificates")
	}
	pub, ok := certs[0].PublicKey.(*rsa.PublicKey)
	if !ok {
		return nil, errors.New("invalid public key type")
	}
	return asn1ber.Marshal(*pub)
}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Retry targeting a host whose TLS certificate uses an RSA key
2. Force an RSA-compatible cipher suite in the TLS config if the server supports both
3. Fall back to standard RDP security when NLA key exchange is impossible

When it happens

Trigger: Thrown at libs/grdp/core/socket.go:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/7513067ed8e1c471. Report an issue: GitHub.