{"record":{"id":"5e86a2cdacca025b","repo":"dgraph-io/dgraph","slug":"unsupported-key","errorCode":null,"errorMessage":"Unsupported key","messagePattern":"Unsupported key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"dgraph/cmd/cert/info.go","lineNumber":106,"sourceCode":"\t\t\tinfo.verifiedCA = \"FAILED\"\n\t\t\tif err := cert.CheckSignatureFrom(parent); err == nil {\n\t\t\t\tinfo.verifiedCA = \"PASSED\"\n\t\t\t}\n\t\t}\n\n\tcase strings.HasSuffix(file, \".key\"):\n\t\tswitch {\n\t\tcase file == defaultCAKey:\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Root CA key\"\n\n\t\tcase file == defaultNodeKey:\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Node key\"\n\n\t\tcase strings.HasPrefix(file, \"client.\"):\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Client key\"\n\n\t\tdefault:\n\t\t\tinfo.err = errors.Errorf(\"Unsupported key\")\n\t\t\treturn &info\n\t\t}\n\n\t\tpriv, err := readKey(file)\n\t\tif err != nil {\n\t\t\tinfo.err = err\n\t\t\treturn &info\n\t\t}\n\t\tkey, ok := priv.(crypto.Signer)\n\t\tif !ok {\n\t\t\tinfo.err = errors.Errorf(\"Unknown private key type: %T\", key)\n\t\t}\n\t\tswitch k := key.(type) {\n\t\tcase *ecdsa.PrivateKey:\n\t\t\tinfo.algo = fmt.Sprintf(\"ECDSA %s (FIPS-3)\", k.PublicKey.Curve.Params().Name)\n\t\t\tinfo.digest = getHexDigest(elliptic.Marshal(k.PublicKey.Curve,\n\t\t\t\tk.PublicKey.X, k.PublicKey.Y))\n\t\tcase *rsa.PrivateKey:","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/info.go#L88-L124","documentation":"The key-inspection branch of getFileInfo classifies private key files by name prefix (node., client., ca.key). A key file with an unrecognized name gets 'Unsupported key' recorded in info.err and is skipped rather than analyzed.","triggerScenarios":"Running `dgraph cert info` in a directory containing a private key file not named ca.key, node.key, or client.<name>.key (e.g. server.key or a backup old.key).","commonSituations":"Manually generated keys copied into the TLS dir, renamed/backup keys, or output from external tooling (openssl genrsa) using different naming.","solutions":["Rename the key to a supported name: ca.key, node.key, or client.<name>.key","Remove unrelated key files from the TLS directory","Regenerate the key pair with `dgraph cert create` so naming matches"],"exampleFix":"// before\ntls/: server.key ...\ndgraph cert info  # server.key -> Unsupported key\n// after\nmv tls/server.key tls/node.key  # then rerun dgraph cert info","handlingStrategy":"validation","validationCode":"func isSupportedKeyName(name string) bool {\n    return name == \"ca.key\" || strings.HasPrefix(name, \"node.\") || strings.HasPrefix(name, \"client.\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep only dgraph-named key files in the TLS directory","Name external keys node.key or client.<user>.key before placing them in the dir","Regenerate keys with dgraph cert create when unsure"],"tags":["tls","keys","naming-convention"],"backgroundTag":"unsupported-file-type","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}