{"record":{"id":"4213417d43bd1d97","repo":"dgraph-io/dgraph","slug":"elliptic-curve-value-must-be-one-of-p224-p256-p","errorCode":null,"errorMessage":"Elliptic curve value must be one of: P224, P256, P384 or P521","messagePattern":"Elliptic curve value must be one of: P224, P256, P384 or P521","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/create.go","lineNumber":269,"sourceCode":"\terr := os.Mkdir(opt.dir, 0700)\n\tif err != nil && !os.IsExist(err) {\n\t\treturn err\n\t}\n\n\tswitch {\n\tcase opt.keySize < keySizeTooSmall:\n\t\treturn errors.New(\"Key size value is too small (x < 512)\")\n\tcase opt.keySize > keySizeTooLarge:\n\t\treturn errors.New(\"Key size value is too large (x > 4096)\")\n\tcase opt.keySize%2 != 0:\n\t\treturn errors.New(\"Key size value must be a factor of 2\")\n\t}\n\n\tswitch opt.curve {\n\tcase \"\":\n\tcase \"P224\", \"P256\", \"P384\", \"P521\":\n\tdefault:\n\t\treturn errors.New(`Elliptic curve value must be one of: P224, P256, P384 or P521`)\n\t}\n\n\t// no path then save it in certsDir.\n\tif filepath.Base(opt.caKey) == opt.caKey {\n\t\topt.caKey = filepath.Join(opt.dir, opt.caKey)\n\t}\n\topt.caCert = filepath.Join(opt.dir, defaultCACert)\n\n\tif err := createCAPair(opt); err != nil {\n\t\treturn err\n\t}\n\tif err := createNodePair(opt); err != nil {\n\t\treturn err\n\t}\n\treturn createClientPair(opt)\n}\n","sourceCodeStart":251,"sourceCodeEnd":286,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/create.go#L251-L286","documentation":"When --curve is specified for dgraph cert create, it must be one of the supported elliptic curves: P224, P256, P384 or P521. An empty string means 'use RSA with --keysize'; any other non-empty value hits the default case and is rejected.","triggerScenarios":"Running `dgraph cert create --curve <name>` where <name> is not exactly P224, P256, P384 or P521 — e.g. --curve p256 (lowercase), --curve P-256, --curve secp256r1, or --curve Ed25519.","commonSituations":"Copying curve names from OpenSSL or Go docs that use different naming (P-256, prime256v1), lowercase names from other tools, or attempting modern curves like Ed25519 that dgraph cert does not support.","solutions":["Use the exact supported names: P224, P256, P384, or P521 (case-sensitive, no hyphen)","Run `dgraph cert create --help` to see the accepted curve values","If a different curve is required, generate certificates with an external tool (e.g. openssl or cfssl) and point dgraph at them"],"exampleFix":"// before\ndgraph cert create --curve p-256\n// after\ndgraph cert create --curve P256","handlingStrategy":"validation","validationCode":"var validCurves = map[string]bool{\"P224\": true, \"P256\": true, \"P384\": true, \"P521\": true}\nfunc validateCurve(c string) error {\n    if c == \"\" || validCurves[c] { return nil }\n    return fmt.Errorf(\"curve %q not supported; use P224, P256, P384 or P521\", c)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use exact Go-style curve names (P256, not p-256/prime256v1/secp256r1)","Check `dgraph cert create --help` for accepted values","For other curves, generate certs externally and import them"],"tags":["cli","tls","validation","ecdsa"],"backgroundTag":"invalid-flag-value","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}