# Unsupported key format "ecdsa-sha2-nistp521"

**URL:** <https://discuss.hashicorp.com/t/unsupported-key-format-ecdsa-sha2-nistp521/53368>\
**Category:** Vault\
**Created:** [May 3, 2023, 9:18am UTC](https://discuss.hashicorp.com/t/unsupported-key-format-ecdsa-sha2-nistp521/53368 "2023-05-03T09:18:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ankit.khandelwal](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@ankit.khandelwal](https://discuss.hashicorp.com/u/ankit.khandelwal)\
**Post date:** [May 3, 2023, 9:18am UTC](https://discuss.hashicorp.com/t/unsupported-key-format-ecdsa-sha2-nistp521/53368/1 "2023-05-03T09:18:44Z")

</div>

Hello Guys,

I have setup SSH Engine for SSH based certificate but when i sign with public key end up getting following error:-

failed to generate signed SSH key: sign error: ssh: unsupported signature algorithm “rsa-sha2-512” for key format “ecdsa-sha2-nistp521”

i was following the document -

> **[SSH - Secrets Engines - HTTP API | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/api-docs/secret/ssh#submit-ca-information)**
>
> This is the API documentation for the Vault SSH secrets engine.

providing key\_type = ecdsa-sha2-nistp521 but under role the Signing Algorithm is only three types which is rsa\* values accepted and due to that its conflicting the same.

Please let me know if ecdsa-sha2-nistp521 is not supported or do we have any fix?

 ![image](https://global.discourse-cdn.com/hashicorp/original/3X/e/2/e2940b1d0b9de59ca89d78a458c9b845b0475eb7.png)  
 ![image](https://global.discourse-cdn.com/hashicorp/original/3X/1/5/157f654ec78c960e0d04f8600ed409a79875996b.png)

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [May 3, 2023, 10:05am UTC](https://discuss.hashicorp.com/t/unsupported-key-format-ecdsa-sha2-nistp521/53368/2 "2023-05-03T10:05:46Z")

</div>

Using an algorithm\_signer of `default` with non-RSA keys works fine for me (testing with Vault 1.13.1):

```auto
    vault secrets enable ssh
    vault write -format=json ssh/config/ca generate_signing_key=true key_type=ecdsa-sha2-nistp521 | jq -r .data.public_key > generated/ssh_ca.pub
    vault write ssh/roles/client - <<"END"
{
    "key_type": "ca",
    "allow_user_certificates": true,
    "allowed_users": "test",
    "algorithm_signer": "default",
    "default_extensions": {
        "permit-pty": "",
        "permit-port-forwarding": ""
    },
    "ttl": "10m"
}
END
    # Sign CA itself with the CA, just as a test signing works
    vault write -format=json ssh/sign/client public_key=@generated/ssh_ca.pub | jq -r .data.signed_key > generated/ssh_ca-cert.pub

```

---

<div class="post-metadata">

**Author:** ![ankit.khandelwal](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@ankit.khandelwal](https://discuss.hashicorp.com/u/ankit.khandelwal)\
**Post date:** [May 3, 2023, 10:38am UTC](https://discuss.hashicorp.com/t/unsupported-key-format-ecdsa-sha2-nistp521/53368/3 "2023-05-03T10:38:00Z")

</div>

Thanks its works well.