{"record":{"id":"11e1bcee72f47950","repo":"dgraph-io/dgraph","slug":"unsupported-certificate","errorCode":null,"errorMessage":"Unsupported certificate","messagePattern":"Unsupported certificate","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"dgraph/cmd/cert/info.go","lineNumber":69,"sourceCode":"\t\tinfo.commonName = cert.Subject.CommonName + \" certificate\"\n\t\tinfo.issuerName = strings.Join(cert.Issuer.Organization, \", \")\n\t\tinfo.serialNumber = hex.EncodeToString(cert.SerialNumber.Bytes())\n\t\tinfo.expireDate = cert.NotAfter\n\n\t\tswitch {\n\t\tcase file == defaultCACert:\n\t\tcase file == defaultNodeCert:\n\t\t\tfor _, ip := range cert.IPAddresses {\n\t\t\t\tinfo.hosts = append(info.hosts, ip.String())\n\t\t\t}\n\t\t\tinfo.hosts = append(info.hosts, cert.DNSNames...)\n\n\t\tcase strings.HasPrefix(file, \"client.\"):\n\t\t\tinfo.commonName = fmt.Sprintf(\"%s client certificate: %s\",\n\t\t\t\tdnCommonNamePrefix, cert.Subject.CommonName)\n\n\t\tdefault:\n\t\t\tinfo.err = errors.Errorf(\"Unsupported certificate\")\n\t\t\treturn &info\n\t\t}\n\n\t\tswitch key := cert.PublicKey.(type) {\n\t\tcase *rsa.PublicKey:\n\t\t\tinfo.digest = getHexDigest(key.N.Bytes())\n\t\tcase *ecdsa.PublicKey:\n\t\t\tinfo.digest = getHexDigest(elliptic.Marshal(key.Curve, key.X, key.Y))\n\t\tdefault:\n\t\t\tinfo.digest = \"Invalid public key\"\n\t\t}\n\n\t\tif file != defaultCACert {\n\t\t\tparent, err := readCert(defaultCACert)\n\t\t\tif err != nil {\n\t\t\t\tinfo.err = errors.Wrapf(err, \"could not read parent cert\")\n\t\t\t\treturn &info\n\t\t\t}","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/info.go#L51-L87","documentation":"When running `dgraph cert info`, getFileInfo classifies each file in the TLS directory by filename prefix (ca.crt, node., client.) to build its info record. A file whose name matches none of the known patterns is flagged 'Unsupported certificate'. It is a per-file error stored in info.err rather than a fatal abort.","triggerScenarios":"Running `dgraph cert info` in a directory containing a certificate file that does not start with 'ca', 'node', or 'client' (e.g. a manually copied server.crt or a backup copy like ca-old.crt).","commonSituations":"Users copying external certs into the dgraph TLS dir, renaming files, keeping rotated/backup certs, or certificates generated by other tools with different naming conventions.","solutions":["Rename the certificate to a supported prefix: ca.crt, node.crt, or client.<name>.crt","Move unrelated certificates out of the TLS directory before running dgraph cert info","Regenerate certificates with `dgraph cert create` so files follow dgraph's naming scheme"],"exampleFix":"// before\nls tls: server.crt  ca.crt\ndgraph cert info --dir tls  # server.crt -> Unsupported certificate\n// after\nmv tls/server.crt tls/client.server.crt  # or node.crt, then rerun dgraph cert info","handlingStrategy":"validation","validationCode":"func isSupportedCertName(name string) bool {\n    return name == \"ca.crt\" || strings.HasPrefix(name, \"node.\") || strings.HasPrefix(name, \"client.\")\n}\n// before running dgraph cert info, ensure every *.crt file passes isSupportedCertName","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep only dgraph-generated files in the TLS directory","Never rename certs to arbitrary names; use node.<host>.crt / client.<user>.crt conventions","Store backups and foreign certs outside the TLS dir"],"tags":["tls","cli","naming-convention"],"backgroundTag":"unsupported-file-type","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}