{"record":{"id":"379d3a67f2c269d8","repo":"nats-io/nats-server","slug":"unsupported-ecc-curve-name","errorCode":null,"errorMessage":"unsupported ECC curve name","messagePattern":"unsupported ECC curve name","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":45,"sourceCode":"\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L27-L63","documentation":"ErrBadECCCurveName is returned when the library maps a Windows cryptographic algorithm/curve identifier to a Go elliptic curve and the name is not one it supports. The library only translates a fixed set of known ECC curve names; anything else is rejected.","triggerScenarios":"On Windows, certKey/extractPublicKey resolves the key's algorithm via CryptoAPI; at certstore_windows.go:898 the curve name lookup in the curve map fails (ok == false) and this error is returned instead of a crypto elliptic.Curve.","commonSituations":"Certificates signed with uncommon curves (e.g. secp256k1, GOST, or newer curve OIDs not in the library's mapping table) used for TLS in the Windows cert store.","solutions":["Use a certificate with a widely supported curve (P-256, P-384, P-521) issued or re-issued accordingly.","Check the cert's signature/public-key algorithm (certutil -v) to confirm which curve is in use.","If a non-standard curve is required, use file-based TLS config (cert_file/key_file parsed by Go's stdlib) instead of the Windows store path.","Update to a newer library version that may support additional curves."],"exampleFix":"// before: cert on unsupported curve secp256k1\n// reissue:\n// after:\n// openssl ecparam -name prime256v1 -genkey -noout -out key.pem\n// openssl req -new -x509 -key key.pem -out cert.pem","handlingStrategy":"validation","validationCode":"// Check the cert's public key curve before configuring store-based TLS\nder, _ := exportCertFromStore(...)\ncert, err := x509.ParseCertificate(der)\nif err == nil {\n    if pk, ok := cert.PublicKey.(*ecdsa.PublicKey); ok {\n        switch pk.Curve.Params().Name {\n        case \"P-256\", \"P-384\", \"P-521\":\n        default:\n            log.Fatalf(\"unsupported curve %s\", pk.Curve.Params().Name)\n        }\n    }\n}","typeGuard":"func isBadCurveErr(err error) bool { return errors.Is(err, certstore.ErrBadECCCurveName) }","tryCatchPattern":"if errors.Is(err, certstore.ErrBadECCCurveName) {\n    // reissue cert with P-256/P-384/P-521 or fall back to cert_file TLS\n}","preventionTips":["Request certs only on P-256/P-384/P-521 curves","Run certutil -v on new certs to confirm curve before rollout","Keep library updated for new curve support"],"tags":["windows","certstore","ecc","curve","unsupported-algorithm"],"backgroundTag":"unsupported-ecc-curve","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}