/errors
签名错误库
签名和密钥相关代码抛出的原始错误信息，以及应对方法。每个条目都会解释这条信息的真正含义，按出现频率对原因排序，并给出附带代码的具体修复方法。
已收录 299 条错误——在可行的情况下，每条信息都用真实的库复现过。
JWT 库33
"alg" (Algorithm) Header Parameter value not allowedjose (JavaScript)"exp" claim timestamp check failedjose (JavaScript)UnauthorizedError: No authorization token was foundexpress-jwt (Node.js)invalid algorithmjsonwebtoken (Node.js)Invalid Compact JWSjose (JavaScript)invalid signaturejsonwebtoken (Node.js)Key for the ES256 algorithm must be one of type CryptoKey, KeyObject, or JSON Web Key.jose (JavaScript)missing required "aud" claimjose (JavaScript)"nbf" claim timestamp check failedjose (JavaScript)unexpected "aud" claim valuejose (JavaScript)unexpected "iss" claim valuejose (JavaScript)"alg" parameter "ES256" requires curve "prime256v1".jsonwebtoken (Node.js)TypeError: "ES256" signatures must be "64" bytes, saw "71"jsonwebtoken / jws / jwa (Node.js)jwt issuer invalid. expected: https://login.example.com/jsonwebtoken (Node.js)jwt must be providedjsonwebtoken (Node.js)jwt not activejsonwebtoken (Node.js)jwt signature is requiredjsonwebtoken (Node.js)secret or public key must be providedjsonwebtoken (Node.js)signature verification failedjose (JavaScript)jwt audience invalid. expected: <audience>jsonwebtoken (Node.js)jwt expiredjsonwebtoken (Node.js)jwt malformedjsonwebtoken (Node.js)It is required that you pass in a value for the "algorithms" argument when calling decode().PyJWT (Python)The specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.PyJWT (Python)Audience doesn't matchPyJWT (Python)Invalid audiencePyJWT (Python)Invalid crypto paddingPyJWT (Python)Not enough segmentsPyJWT (Python)Signature has expiredPyJWT (Python)Signature verification failedPyJWT (Python)The specified alg value is not allowedPyJWT (Python)The token is not yet valid (iat)PyJWT (Python)secretOrPublicKey must be an asymmetric key when using ES256jsonwebtoken (Node.js)
Node.js crypto 模块15
error:0308010C:digital envelope routines::unsupportedNode.js 17+ (OpenSSL 3)error:1E08010C:DECODER routines::unsupportedNode.js crypto (OpenSSL 3)Failed to read asymmetric keyNode.js cryptoInvalid JWK EC keyNode.js cryptoInvalid key object type public, expected private.Node.js cryptocertificate has expiredNode.js tls / https / fetchClient network socket disconnected before secure TLS connection was establishedNode.js tls / https / fetchcode: 'DEPTH_ZERO_SELF_SIGNED_CERT'Node.js tls / https / fetchcode: 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE'Node.js tls.connect / fetchcode: 'ERR_SSL_WRONG_VERSION_NUMBER'Node.js tls.connect / fetch (undici)Hostname/IP does not match certificate's altnames: Host: api.example.com. is not in the cert's altnames: DNS:www.example.comNode.js tls.checkServerIdentity()Warning: Ignoring extra certs from `/etc/ssl/private-ca/corp-root-ca.pem`, load failed: error:80000002:system library::No such file or directoryNode.js start-upself-signed certificate in certificate chainNode.js tls / https / fetchunable to get local issuer certificateNode.js tls / https / fetchunable to verify the first certificateNode.js tls / https / fetch
WebCrypto9
TypeError: Cannot read properties of undefined (reading 'digest')WebCryptoDataError: Data provided to an operation does not meet requirementsWebCrypto crypto.subtle.importKeyTypeError: Failed to execute 'sign' on 'SubtleCrypto': EcdsaParams: hash: Missing or not an AlgorithmIdentifierWebCrypto SubtleCrypto.sign / verify with ECDSAInvalidAccessError: Failed to execute 'exportKey' on 'SubtleCrypto': key is not extractableWebCrypto SubtleCrypto.exportKey / wrapKeyTypeError: Failed to execute 'importKey' on 'SubtleCrypto': The provided value is not of type '(ArrayBuffer or ArrayBufferView or JsonWebKey)'.WebCrypto SubtleCrypto.importKeyInvalidAccessError: Unable to use this key to verifyWebCrypto crypto.subtle.sign / verifyOperationError: The operation failed for an operation-specific reasonWebCrypto crypto.subtleSyntaxError: Cannot create a key using the specified key usages.WebCrypto SubtleCrypto.importKey / generateKeyNotSupportedError: Unrecognized algorithm nameWebCrypto crypto.subtle
OpenSSL CLI25
error:0680009B:asn1 encoding routines:ASN1_get_object:too longOpenSSL 3.x CLI (asn1parse, d2i loaders)SSL routines:ssl3_read_bytes:ssl/tls alert bad certificateOpenSSLSSL routines:ssl3_read_bytes:ssl/tls alert handshake failureOpenSSL (client side)SSL routines:tls_setup_handshake:no protocols availableOpenSSL (client or server side)SSL routines:tls_post_process_client_hello:no shared cipherOpenSSL (server side: nginx, Apache, Postfix, openssl s_server)SSL routines:tls_process_client_certificate:peer did not return a certificateOpenSSL (server side, mutual TLS)SSL routines:ssl3_read_bytes:tlsv1 alert protocol versionOpenSSL (client side)SSL_do_handshake() failed (SSL: error:0A000418:SSL routines::tlsv1 alert unknown ca:SSL alert number 48)nginx error log / OpenSSLSSL routines:ssl3_read_bytes:tlsv1 unrecognized nameOpenSSL (client side)SSL routines:ssl3_read_bytes:tlsv13 alert certificate requiredOpenSSL (client side)error:0A000126:SSL routines::unexpected eof while readingOpenSSL 3SSL routines:ssl_choose_client_version:unsupported protocolOpenSSL (client side)Verification failureOpenSSL CLI (openssl dgst -verify)verify error:num=10:certificate has expiredOpenSSL CLI (openssl s_client / openssl verify)verify error:num=18:self-signed certificateOpenSSL CLI (openssl s_client / openssl verify)verify error:num=19:self-signed certificate in certificate chainOpenSSL CLI (openssl s_client / openssl verify)verify error:num=20:unable to get local issuer certificateOpenSSL CLI (openssl s_client / openssl verify)verify error:num=21:unable to verify the first certificateOpenSSL CLI (openssl s_client)verify error:num=26:unsuitable certificate purposeOpenSSL CLI (openssl s_client / openssl verify -purpose)verify error:num=79:invalid CA certificateOpenSSL 3.x CLI (openssl s_client / openssl verify)SSL routines:tls_validate_record_header:wrong version numberOpenSSL 3 (openssl s_client and any OpenSSL-based client)error:05800074:x509 certificate routines::key values mismatchOpenSSL 3error:0480006C:PEM routines::no start lineOpenSSL 3.xunable to load certificateOpenSSL CLI (openssl x509 / verify)unable to load Public KeyOpenSSL CLI (openssl pkey / ec / rsa / dgst)
Python cryptography 库23
cryptography.exceptions.InvalidSignaturePython cryptographyPassword was not given but private key is encryptedPython cryptographyInvalid EC key. Point is not on the curve specified.Python cryptography[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked criticalPython 3.13+ ssl module[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: CA cert does not include key usage extensionPython 3.13+ ssl module[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expiredPython ssl module (OpenSSL)[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'api.example.com'.Python ssl module (OpenSSL host check)[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key IdentifierPython 3.13+ ssl module[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificatePython ssl module (OpenSSL)[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chainPython ssl module (OpenSSL)[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificatePython ssl module (OpenSSL)Could not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).Python cryptographyIncorrect password, could not decrypt keyPython cryptographyPassword was given but private key is not encrypted.Python cryptographyMax retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificaterequests / urllib3 (Python)[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failurePython ssl module (OpenSSL)[SSL: DH_KEY_TOO_SMALL] dh key too smallPython ssl module (OpenSSL, security level 2)[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocolPython ssl module (OpenSSL)[SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabledPython ssl module (OpenSSL 3)[SSL: WRONG_VERSION_NUMBER] wrong version numberPython ssl module (OpenSSL)<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificatePython urllib.requestUnable to load PEM file. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details. MalformedFramingPython cryptographyValid PEM but no BEGIN PUBLIC KEY/END PUBLIC KEY delimiters. Are you sure this is a public key?Python cryptography
Go33
asn1: structure error: tags don't matchGo encoding/asn1http: server gave HTTP response to HTTPS clientGo net/httpgo-jose/go-jose: error in cryptographic primitivego-jose (Go)oidc: expected audience "api-client" got ["web-client"]coreos/go-oidc (Go)failed to verify signature: failed to verify id token signaturecoreos/go-oidc (Go)oidc: issuer URL provided to client ("https://accounts.example.com") did not match the issuer URL returned by provider ("https://accounts.example.com/")coreos/go-oidc (Go)oidc: malformed jwt: unexpected signature algorithm "ES256"; expected ["RS256"]coreos/go-oidc (Go)remote error: tls: bad certificateGo crypto/tlsremote error: tls: handshake failureGo crypto/tls clientremote error: tls: unknown certificate authorityGo crypto/tlsssh: handshake failed: knownhosts: key is unknowngolang.org/x/crypto/ssh/knownhosts (Go)ssh: this private key is passphrase protectedgolang.org/x/crypto/ssh (Go)ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remaingolang.org/x/crypto/ssh (Go)tls: client offered only unsupported versions: [301]Go crypto/tls server (net/http ErrorLog)tls: first record does not look like a TLS handshakeGo crypto/tlstls: server selected unsupported protocol version 301Go crypto/tls clientx509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANsGo crypto/x509x509: certificate is not valid for any names, but wanted to match api.example.comGo crypto/x509x509: certificate relies on legacy Common Name field, use SANs insteadGo crypto/x509x509: certificate specifies an incompatible key usageGo crypto/x509x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)Go crypto/x509x509: invalid signature: parent certificate cannot sign this kind of certificateGo crypto/x509token signature is invalid: key is of invalid type: ECDSA verify expects *ecdsa.PublicKeygolang-jwt/jwt (Go)token signature is invalid: signing method ES256 is invalidgolang-jwt/jwt (Go)token has invalid claims: token is expiredgolang-jwt/jwt (Go)token is malformed: token contains an invalid number of segmentsgolang-jwt/jwt (Go)token is unverifiable: error while executing keyfunc: kid "2026-10" not found in key setgolang-jwt/jwt (Go)token signature is invalid: crypto/ecdsa: verification errorgolang-jwt/jwt (Go)tls: failed to verify certificate: x509: certificate signed by unknown authorityGo crypto/tls (Go ≥ 1.20)x509: certificate has expired or is not yet valid: current time 2026-08-20T15:47:41+03:00 is after 2026-08-19T12:47:41ZGo crypto/x509x509: certificate is valid for example.com, not api.example.comGo crypto/x509x509: certificate signed by unknown authorityGo crypto/x509x509: unsupported elliptic curveGo crypto/x509
Java24
java.security.cert.CertPathValidatorException: Algorithm constraints check failed on keysize limits: RSA 768 bit key used with certificate: CN=api.example.comJava (PKIX validator)java.security.InvalidAlgorithmParameterException: Curve not supported: secp256k1 (1.3.132.0.10)Java (JDK 16+)java.lang.IllegalArgumentException: Illegal base64 character 2dJava (JDK)algid parse error, not a sequenceJava (JDK)No appropriate protocol (protocol is disabled or cipher suites are inappropriate)Java (JSSE)java.security.InvalidKeyException: No installed provider supports this key: sun.security.rsa.RSAPublicKeyImplJava (JDK)No subject alternative DNS name matching api.example.com found.Java (JSSE HostnameChecker)No subject alternative names matching IP address 127.0.0.1 foundJava (JSSE HostnameChecker)No subject alternative names presentJava (JSSE HostnameChecker)PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetJava (JSSE, SunX509 trust manager)PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failedJava (JSSE)javax.net.ssl.SSLHandshakeException: (handshake_failure) Received fatal alert: handshake_failureJava (JSSE)javax.net.ssl.SSLHandshakeException: (protocol_version) Received fatal alert: protocol_versionJava (JSSE)javax.net.ssl.SSLHandshakeException: Remote host terminated the handshakeJava (JSSE)The server selected protocol version TLS10 is not accepted by client preferences [TLS13, TLS12]Java (JSSE)java.security.SignatureException: Invalid encoding for signatureJava (JDK)java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-emptyJava (JSSE / PKIX)javax.net.ssl.SSLHandshakeException: (unrecognized_name) Received fatal alert: unrecognized_nameJava (JSSE)javax.net.ssl.SSLException: Unsupported or unrecognized SSL messageJava (JSSE)Invalid compact JWT string: Compact JWSs must contain exactly 2 period characters, and compact JWEs must contain exactly 4. Found: 0JJWT (Java)JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted.JJWT (Java)The specified key byte array is 96 bits which is not secure enough for any JWT HMAC-SHA algorithm.JJWT (Java)Signed JWT rejected: Another algorithm expected, or no matching key(s) foundNimbus JOSE + JWT (Java)Signed JWT rejected: Invalid signatureNimbus JOSE + JWT (Java)
.NET18
System.Security.Cryptography.CryptographicException: ASN1 corrupted data..NET System.Security.CryptographyCannot determine the frame size or a corrupted frame was received..NET SslStream / HttpClientIDX10205: Issuer validation failed. Issuer: 'https://sts.windows.net/Microsoft.IdentityModel.Tokens (.NET)IDX10214: Audience validation failed.Microsoft.IdentityModel.Tokens (.NET)IDX10223: Lifetime validation failed. The token is expired.Microsoft.IdentityModel.Tokens (.NET)IDX10503: Signature validation failed. The token's kid is: '2026-10', but did not match any keys in TokenValidationParameters or Configuration.Microsoft.IdentityModel.JsonWebTokens / System.IdentityModel.Tokens.Jwt (.NET)IDX10511: Signature validation failed. Keys tried:Microsoft.IdentityModel.JsonWebTokens / System.IdentityModel.Tokens.Jwt (.NET)IDX10720: Unable to create KeyedHashAlgorithm for algorithm 'HS256', the key size must be greater than: '256' bits, key has '128' bits.Microsoft.IdentityModel.Tokens (.NET)IDX20803: Unable to obtain configuration from: 'http://keycloak:8080/realms/main/.well-known/openid-configuration'.Microsoft.IdentityModel.Protocols (.NET)No supported key formats were found. Check that the input represents the contents of a PEM-encoded key file, not the path to such a file. (Parameter 'input').NET System.Security.CryptographyReceived an unexpected EOF or 0 bytes from the transport stream..NET SslStream / HttpClientThe remote certificate is invalid because of errors in the certificate chain: NotTimeValid.NET SslStream / HttpClientThe remote certificate is invalid because of errors in the certificate chain: PartialChain.NET SslStream / HttpClientThe remote certificate is invalid because of errors in the certificate chain: UntrustedRoot.NET SslStream / HttpClientThe remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch.NET SslStream / HttpClientThe remote certificate was rejected by the provided RemoteCertificateValidationCallback..NET SslStream / HttpClientSSL Handshake failed with OpenSSL error - SSL_ERROR_SSL..NET on Linux (SslStream over OpenSSL)The SSL connection could not be established, see inner exception..NET HttpClient
Rust9
invalid peer certificate: certificate expired: verification timerustls 0.23 (via reqwest, ureq, hyper-rustls)invalid peer certificate: certificate not valid for name "api.example.com"; certificate is only valid for DnsName("www.example.com")rustls 0.23 (via reqwest, ureq, hyper-rustls)invalid peer certificate: UnknownIssuerrustls (via reqwest, ureq, hyper-rustls, tonic)Error(InvalidAlgorithm)jsonwebtoken (Rust crate)Error(InvalidKeyFormat)jsonwebtoken (Rust crate)Error(InvalidSignature)jsonwebtoken (Rust crate)received corrupt message of type InvalidContentTyperustls (via reqwest, ureq, tonic)received fatal alert: HandshakeFailurerustls (via reqwest, ureq, tonic)KeyRejected("InvalidEncoding")ring (Rust crate)
PHP9
cURL error 60: SSL certificate problem: unable to get local issuer certificatePHPcURL error 77: error setting certificate file: /etc/ssl/missing-ca.pemPHP ext-curl (Guzzle, Laravel HTTP client)"kid" invalid, unable to lookup correct keyfirebase/php-jwt (PHP)Provided key is too shortfirebase/php-jwt 7.x (PHP)Firebase\JWT\SignatureInvalidException: Signature verification failedfirebase/php-jwt (PHP)Wrong number of segmentsfirebase/php-jwt (PHP)openssl_verify(): Supplied key param cannot be coerced into a public keyPHP OpenSSL extensionPeer certificate subjectAltName did not match expected name `api.example.com'PHP streams (openssl stream wrapper)SSL operation failed with code 1. OpenSSL Error messages:PHP streams (file_get_contents, fopen, stream_socket_client, SoapClient, mail libraries)
Ruby8
state=error: certificate verify failed (certificate has expired)Ruby openssl (Net::HTTP, Faraday, RubyGems)state=error: certificate verify failed (hostname mismatch)Ruby openssl (Net::HTTP verify_hostname, default true)state=error: certificate verify failed (self-signed certificate in certificate chain)Ruby openssl (Net::HTTP, Faraday, RubyGems)state=error: certificate verify failed (unable to get local issuer certificate)Ruby openssl (Net::HTTP, Faraday, HTTParty, RubyGems)Expected a different algorithm (JWT::IncorrectAlgorithm)ruby-jwt (Ruby)Not enough or too many segmentsruby-jwt (Ruby)Signature verification failed (JWT::VerificationError)ruby-jwt (Ruby)Could not parse PKey (OpenSSL::PKey::PKeyError)Ruby openssl gem
浏览器9
net::ERR_SSL_PROTOCOL_ERRORChrome, Edge and other Chromium browsersnet::ERR_SSL_VERSION_OR_CIPHER_MISMATCHChrome, Edge and other Chromium browsersnet::ERR_CERT_AUTHORITY_INVALIDChrome, Edge and other Chromium browsersnet::ERR_CERT_COMMON_NAME_INVALIDChrome, Edge and other Chromium browsersnet::ERR_CERT_DATE_INVALIDChrome, Edge and other Chromium browsersSEC_ERROR_EXPIRED_CERTIFICATEFirefox (NSS)SEC_ERROR_UNKNOWN_ISSUERFirefox (NSS)SSL_ERROR_BAD_CERT_DOMAINFirefoxSSL_ERROR_UNSUPPORTED_VERSIONFirefox
curl15
curl: (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failurecurl (OpenSSL backend)curl: (35) TLS connect error: error:0A00042E:SSL routines::tlsv1 alert protocol versioncurl (OpenSSL backend)curl: (35) TLS connect error: error:0A000102:SSL routines::unsupported protocolcurl (OpenSSL backend)curl: (35) TLS connect error: error:0A00010B:SSL routines::wrong version numbercurl (OpenSSL backend)curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0curl (OpenSSL 3 backend)curl: (60) SSL certificate problem: certificate has expiredcurl (OpenSSL backend)curl: (60) SSL: no alternative certificate subject name matches target hostname 'api.example.com'curl (OpenSSL backend)curl: (60) SSL certificate problem: self-signed certificatecurl (OpenSSL backend)curl: (60) SSL certificate problem: self-signed certificate in certificate chaincurl (OpenSSL backend)curl: (60) SSL certificate problem: unable to get local issuer certificatecurl (OpenSSL backend)curl: (77) error setting certificate file: /etc/pki/tls/certs/ca-bundle.crtcurl (OpenSSL backend)ERROR: cannot verify api.example.com's certificate, issued by 'CN=Example Private CA':GNU Wget built with OpenSSL (Ubuntu 22.04+, Alpine, RHEL/CentOS)ERROR: The certificate of 'api.example.com' has expired.GNU Wget built with GnuTLS (Debian)ERROR: The certificate of 'api.example.com' is not trusted.GNU Wget built with GnuTLS (Debian, Ubuntu before 22.04 used it too)The certificate's owner does not match hostname 'api.example.com'GNU Wget (GnuTLS build); the alias is the OpenSSL build's wording
Git10
GnuTLS recv error (-110): The TLS connection was non-properly terminated.git over HTTPS with libcurl-gnutls (Debian, Ubuntu)gpg: signing failed: Inappropriate ioctl for deviceGit commit signing with GnuPG 2error: gpg failed to sign the dataGit (commit -S, tag -s, commit.gpgsign) with GnuPGfatal: unable to access 'https://git.example.com/team/app.git/': server verification failed: certificate signer not trusted. (CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none)git over HTTPS with libcurl-gnutls (Debian, Ubuntu)error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verificationGit (verify-commit, log --show-signature, merge --verify-signatures) with gpg.format=sshfatal: unable to access 'https://git.example.com/team/app.git/': SSL certificate problem: self-signed certificate in certificate chaingit over HTTPS with libcurl + OpenSSL (Git for Windows default, macOS Homebrew, Alpine, RHEL)fatal: unable to access 'https://git.example.com/team/app.git/': SSL certificate problem: unable to get local issuer certificategit over HTTPS with libcurl + OpenSSL (Git for Windows default, macOS Homebrew, Alpine, RHEL)fatal: unable to access 'https://git.example.com/team/app.git/': SSL: certificate subject name (www.example.com) does not match target hostname 'git.example.com'git over HTTPS with libcurl-gnutls (Debian, Ubuntu)gpg: BAD signature from "Release Bot <release@example.com>" [ultimate]GnuPG (gpg --verify, git verify-commit / verify-tag)gpg: Can't check signature: No public keyGnuPG (gpg --verify, git verify-commit / verify-tag / log --show-signature)
包管理器13
1 package has an invalid registry signature:npm audit signatures (npm 9.5+)npm error code CERT_HAS_EXPIREDnpm (Node.js)npm error code DEPTH_ZERO_SELF_SIGNED_CERTnpm (Node.js)npm error code ERR_TLS_CERT_ALTNAME_INVALIDnpm (Node.js)Automatic provenance generation not supported for provider: nullnpm publish --provenance (npm 9.5+)npm error code SELF_SIGNED_CERT_IN_CHAINnpm (Node.js)npm error code UNABLE_TO_GET_ISSUER_CERT_LOCALLYnpm (Node.js)npm error code UNABLE_TO_VERIFY_LEAF_SIGNATUREnpm (Node.js)There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failedpipError: ERR_PNPM_RESOLVING_NPM_RESOLVER_NETWORK_ERRORpnpm 12 (native binary, rustls)Could not verify the SSL certificate for https://gems.example.com/.Bundlererror Error: self-signed certificate in certificate chainYarn Classic (1.x)error Error: unable to get local issuer certificateYarn Classic (1.x); Yarn 4 prints the alias
Docker 与 Kubernetes5
Error response from daemon: Get "https://registry.example.com:5000/v2/": tls: failed to verify certificate: x509: certificate signed by unknown authorityDocker Engine (dockerd)Unable to connect to the server: tls: failed to verify certificate: x509: certificate has expired or is not yet validkubectl (client-go)Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 192.168.1.10, not 127.0.0.1kubectl (client-go)Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authoritykubectl (client-go)x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")kubectl and other Go clients
DKIM4
dkim=fail (body hash did not verify)DKIM verifiers (Gmail, mailauth, Rspamd…)dkim=permerrorOpenDKIM (Authentication-Results); mailauth reports syntax errors as dkim=neutraldkim=fail reason="key not found in DNS"OpenDKIM (Authentication-Results); mailauth reports it as dkim=neutral (no key)dkim=fail reason="signature verification failed"OpenDKIM (Authentication-Results header added by the opendkim milter); mailauth reports the same as "bad signature"
WebAuthn 与通行密钥4
Unexpected registration response origin "http://localhost:3000", expected "https://app.example.com"SimpleWebAuthn (@simplewebauthn/server)InvalidStateError: The user attempted to register an authenticator that contains one of the credentials already registered with the relying party.WebAuthn navigator.credentials.create() with excludeCredentialsNotAllowedError: The operation either timed out or was not allowed. See: https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.WebAuthn navigator.credentials.get() / create()SecurityError: The relying party ID is not a registrable domain suffix of, nor equal to the current domain. Subsequently, an attempt to fetch the .well-known/webauthn resource of the claimed RP ID failed.WebAuthn navigator.credentials.create() / get()
Web3 钱包与签名10
Address does not refer to keyBitcoin Core RPCMalformed base64 encodingBitcoin Core RPCambiguous primary types or unused types: "EIP712Domain", "Mail"ethers v6 (JavaScript)invalid raw signature lengthethers v6 (JavaScript)Provided chainId "1" must match the active chainId "137"MetaMask (eth_signTypedData_v3/v4)Invalid primary type `Email` must be one of `["EIP712Domain","Mail"]`.viem (TypeScript)invalid signature lengthviem (TypeScript)Invalid yParityOrV valueviem (TypeScript)eth_keys.exceptions.BadSignature: Invalid signatureweb3.py / eth-account / eth-keys (Python)Unexpected recoverable signature length: Expected 65, but got 64 bytesweb3.py / eth-account / eth-keys (Python)
JWKS 与密钥发现7
Jwks doesn't have key to match kid or alg from JwtEnvoy / IstioExpected 200 OK from the JSON Web Key Set HTTP responsejose (JavaScript)multiple matching keys found in the JSON Web Key Setjose (JavaScript)no applicable key found in the JSON Web Key Setjose (JavaScript)The JWKS endpoint did not contain any signing keysjwks-rsa (Node.js)Unable to find a signing key that matches '2026-10-rotated'jwks-rsa (Node.js)Unable to find a signing key that matches: "2026-10"PyJWT (Python)
SSH10
sign_and_send_pubkey: signing failed for RSA "/path/to/key" from agent: agent refused operationOpenSSH client with an SSH agent (ssh-agent, gpg-agent, 1Password, Secretive, Windows OpenSSH agent)Load key "/path/to/key": error in libcryptoOpenSSH (ssh, ssh-add, ssh-keygen, git over SSH)Host key verification failed.OpenSSH client (ssh, scp, git over SSH) with StrictHostKeyChecking / BatchModeLoad key "/path/to/key": incorrect passphrase supplied to decrypt private keyOpenSSH (ssh-keygen, ssh-add, ssh)Unable to negotiate with 127.0.0.1 port 22: no matching host key type found. Their offer: ssh-rsaOpenSSH client (8.8+) connecting to a server that only offers legacy host key algorithmsPermission denied (publickey).OpenSSH client (ssh, scp, sftp, git over SSH)WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!OpenSSH clientWARNING: UNPROTECTED PRIVATE KEY FILE!OpenSSH client (ssh, ssh-add, scp, git over SSH)Signature verification failed: incorrect signatureOpenSSH ssh-keygen -Y verify (SSHSIG)userauth_pubkey: signature algorithm ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]OpenSSH server (sshd) log
其他工具6
Malformed UTF-8 dataCryptoJS400 No required SSL certificate was sentnginx--certificate-identity or --certificate-identity-regexp is required for verification in keyless modeSigstore cosign 2.x/3.xdecrypt: encrypted: decryption failedSigstore cosign (sign, sign-blob, attest, public-key with --key cosign.key)invalid signature when validating ASN.1 encoded signatureSigstore cosign (verify-blob / verify with --key)Load key "/path/to/key": invalid formatOpenSSH
错误未收录，或已收录但仍未解决？
签名错误诊断工具从另一个方向入手：你粘贴密钥、消息和签名后，它会在你的浏览器本地测试常见的不匹配原因——哈希算法错误、曲线错误、DER 与原始编码混淆、双重哈希。
打开错误诊断工具