Getting error: "Bad signature length"

[henryharrod]

When using Google Cloud KMS, I'm getting the following error when using jsign to sign a .exe in Debian. Any ideas what might be causing it?

net.jsign.bouncycastle.operator.RuntimeOperatorException: exception obtaining signature: Bad signature length: got 512 but was expecting 256
	at net.jsign.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder$SigVerifier.verify(Unknown Source)
	at net.jsign.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder$RawSigVerifier.verify(Unknown Source)
	at net.jsign.bouncycastle.cms.SignerInformation.doVerify(Unknown Source)
	at net.jsign.bouncycastle.cms.SignerInformation.verify(Unknown Source)
	at net.jsign.AuthenticodeSigner.createSignedData(AuthenticodeSigner.java:368)
	at net.jsign.AuthenticodeSigner.sign(AuthenticodeSigner.java:338)
	at net.jsign.SignerHelper.sign(SignerHelper.java:550)
	at net.jsign.JsignCLI.execute(JsignCLI.java:117)
	at net.jsign.JsignCLI.main(JsignCLI.java:40)
Caused by: java.security.SignatureException: Bad signature length: got 512 but was expecting 256
	at java.base/sun.security.rsa.RSASignature.engineVerify(RSASignature.java:215)
	at java.base/java.security.Signature$Delegate.engineVerify(Signature.java:1435)
	at java.base/java.security.Signature.verify(Signature.java:789)
	... 9 more
Try `java -jar jsign.jar --help' for more information.

[ebourg]

It looks like the private key in Google Cloud KMS is a 4096 bit key, but the public key in the certificate is a 2048 bit key.

[oleksii-tymofieiev]

@ebourg I seem to have the same issue.

Should the certifying company re-issue the certs for us to correspond to the private key?

JIC I am building the full chain using this command:
gcloud kms keys versions get-certificate-chain 1 \ --key key_name \ --location location \ --keyring keyring_name \ --output-file google-full-chain.pem

[ebourg]

Does google-full-chain.pem contain your signing certificate, or only the root and intermediate CA certificates?

[oleksii-tymofieiev]

There were 4 entities in the generated file.

I tried to generate the same manually with cat and in this case the chain was accepted.

So the issue was probably with how my initial file was generated.