{"record":{"id":"01cb79e39ae2dd26","repo":"dgraph-io/dgraph","slug":"key-size-value-is-too-large-x-4096","errorCode":null,"errorMessage":"Key size value is too large (x > 4096)","messagePattern":"Key size value is too large \\(x > 4096\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/create.go","lineNumber":260,"sourceCode":"func createCerts(opt *options) error {\n\tif opt == nil {\n\t\treturn errors.New(\"nil options\")\n\t}\n\n\tif opt.dir == \"\" {\n\t\treturn errors.New(\"Invalid TLS directory\")\n\t}\n\n\terr := os.Mkdir(opt.dir, 0700)\n\tif err != nil && !os.IsExist(err) {\n\t\treturn err\n\t}\n\n\tswitch {\n\tcase opt.keySize < keySizeTooSmall:\n\t\treturn errors.New(\"Key size value is too small (x < 512)\")\n\tcase opt.keySize > keySizeTooLarge:\n\t\treturn errors.New(\"Key size value is too large (x > 4096)\")\n\tcase opt.keySize%2 != 0:\n\t\treturn errors.New(\"Key size value must be a factor of 2\")\n\t}\n\n\tswitch opt.curve {\n\tcase \"\":\n\tcase \"P224\", \"P256\", \"P384\", \"P521\":\n\tdefault:\n\t\treturn errors.New(`Elliptic curve value must be one of: P224, P256, P384 or P521`)\n\t}\n\n\t// no path then save it in certsDir.\n\tif filepath.Base(opt.caKey) == opt.caKey {\n\t\topt.caKey = filepath.Join(opt.dir, opt.caKey)\n\t}\n\topt.caCert = filepath.Join(opt.dir, defaultCACert)\n\n\tif err := createCAPair(opt); err != nil {","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/create.go#L242-L278","documentation":"dgraph cert create validates the RSA key size requested via --keysize before generating certificates. createCerts rejects any value above keySizeTooLarge (4096 bits) because such keys are slow to generate and exceed the tool's supported range. The error is returned from createCerts and aborts certificate creation before any files are written.","triggerScenarios":"Running `dgraph cert create --keysize N` where N > 4096 (e.g. --keysize 8192). The opt.keySize value is parsed from flags and checked in the first switch of createCerts.","commonSituations":"Operators trying to 'harden' TLS by requesting 8192-bit RSA keys, or passing a keysize in a nonstandard unit (e.g. bits vs bytes confusion) or copying examples that use larger sizes than dgraph supports.","solutions":["Use a key size between 512 and 4096 bits; 2048 is the common secure choice","Run `dgraph cert create --help` to confirm the supported range (keySizeTooSmall=512, keySizeTooLarge=4096)","If higher strength is needed, switch to an ECDSA curve (P256/P384/P521) instead of a huge RSA key"],"exampleFix":"// before\ndgraph cert create --keysize 8192\n// after\ndgraph cert create --keysize 2048","handlingStrategy":"validation","validationCode":"const minKeySize, maxKeySize = 512, 4096\nfunc validateKeySize(n int) error {\n    if n < minKeySize { return fmt.Errorf(\"key size %d too small (< %d)\", n, minKeySize) }\n    if n > maxKeySize { return fmt.Errorf(\"key size %d too large (> %d)\", n, maxKeySize) }\n    if n%2 != 0 { return fmt.Errorf(\"key size %d must be a factor of 2\", n) }\n    return nil\n}\n// call before: if err := validateKeySize(*keySizeFlag); err != nil { return err }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use standard sizes (1024/2048/4096); 2048 is the typical choice","Clamp or validate scripted keysize values before passing them to dgraph cert create","Prefer ECDSA curves (P256/P384) over very large RSA keys"],"tags":["cli","tls","validation","input-validation"],"backgroundTag":"invalid-flag-value","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}