How to fix ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported

Question

How to fix ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported

Bhagat, Anil 20

Hi All,

I am using Azure Default Xero connector + OAuth2.0 flow. I have supplied the required information

Client ID
Client Secret
Tenant Id
REfresh Token

If I click on TEst Connection , I get below mentioned error. Can you please help ?

ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported

Anonymous

2025-08-29T18:06:31.5533333+00:00
Hi @Bhagat, Anil

Thanks for your query on Microsoft Q&A!

I would like to add few more details to the Amira's suggestion.

This error occurs because the connector’s cryptographic library cannot decode the format of the RSA private key used to sign the JWT assertion for Xero’s OAuth 2.0 flow. Specifically, the connector expects the private key to be in PKCS#8 format.

you might be using PKCS#1 key (BEGIN RSA PRIVATE KEY) instead of PKCS#8 (BEGIN PRIVATE KEY)

Thanks for confirming that you are using OAuth2.0 for linked service and can you please try below steps to mitigate the issue.

**1. Convert Your RSA Key to PKCS#8 Format:**If you have a .pem key in PKCS#1 format, convert it using OpenSSL:

openssl pkcs8 -topk8 -inform PEM -outform PEM -in rsa_key.pem -out key_pkcs8.pem -nocrypt

This creates an unencrypted PKCS#8 key compatible with the connector.

**2. Bundle the Key and Certificate into a PFX File:**Use OpenSSL to create a .pfx file:

openssl pkcs12 -export -inkey key_pkcs8.pem -in cert.pem -out xero_cert.pfx -nodes

If you prefer to set a password, omit -nodes and add -password pass:<YourPassword>.

3. Convert the PFX to Base64: Many Azure connectors require the certificate in Base64 format.

$bytes = [IO.File]::ReadAllBytes("xero_cert.pfx") [Convert]::ToBase64String($bytes) | Out-File -FilePath "xero_cert_base64.txt"

4. Configure the Xero Linked Service: In Azure Data Factory or Synapse:

Go to Manage > Linked Services > + New > Xero

Choose OAuth 2.0 as the authentication type

Enter your Client ID, Client Secret, Tenant ID, and Refresh Token

Paste the Base64 string from xero_cert_base64.txt into the Certificate field

Enter the PFX password if applicable

Click Test Connection

Please let us know how this working for you, if issue still persist can share screenshots for error message and configuration of linked service? and confirm following

Did the configuration work previously (i.e., was it ever successfully connected)?

Can you confirm if you accidentally selected any other authentication method in the settings?

Hope you have required privileges to access the client id and client secrets.

Thanks!

Kalyani

2 answers

Your answer

Answer 1

Hello Bhagat, Anil,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to fix all the errors.

@Amira Bedhiafi have done a lot of justice in providing best resolution, just an addition to her response on Xero refresh tokens rotate. In Xero’s OAuth 2.0 flow, every time you use a refresh token to get a new access token, you also receive a brand-new refresh token, and the old one immediately becomes invalid. If you don’t update and store the latest refresh token (for example, in Azure Key Vault), future connection attempts will fail even if the initial test connection worked. This refresh-token rotation is a common follow-up issue in Xero integrations and is worth highlighting. Check for more details here - https://developer.xero.com/documentation/oauth2/overview

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

3 deleted comments

Comments have been turned off. Learn more