{"record":{"id":"7e7ccdfd6fd2981e","repo":"slackhq/nebula","slug":"invalid-curve-s-7e7ccd","errorCode":null,"errorMessage":"invalid curve: %s","messagePattern":"invalid curve: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":296,"sourceCode":"\t\t\t}\n\t\tcase \"P256\":\n\t\t\tvar key *ecdsa.PrivateKey\n\t\t\tcurve = cert.Curve_P256\n\t\t\tkey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while generating ecdsa keys: %s\", err)\n\t\t\t}\n\n\t\t\t// ecdh.PrivateKey lets us get at the encoded bytes, even though\n\t\t\t// we aren't using ECDH here.\n\t\t\teKey, err := key.ECDH()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while converting ecdsa key: %s\", err)\n\t\t\t}\n\t\t\trawPriv = eKey.Bytes()\n\t\t\tpub = eKey.PublicKey().Bytes()\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve: %s\", *cf.curve)\n\t\t}\n\t}\n\n\tt := &cert.TBSCertificate{\n\t\tVersion:        version,\n\t\tName:           *cf.name,\n\t\tGroups:         groups,\n\t\tNetworks:       networks,\n\t\tUnsafeNetworks: unsafeNetworks,\n\t\tNotBefore:      time.Now(),\n\t\tNotAfter:       time.Now().Add(*cf.duration),\n\t\tPublicKey:      pub,\n\t\tIsCA:           true,\n\t\tCurve:          curve,\n\t}\n\n\tif !isP11 && !isStdio(*cf.outKeyPath) {\n\t\tif _, err := os.Stat(*cf.outKeyPath); err == nil {","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L278-L314","documentation":"Returned when -curve given to `nebula-cert ca` is not one of the recognized values (25519/X25519/Curve25519/CURVE25519 or P256) in non-PKCS#11 mode. It is a pure input-validation error listing no valid alternatives, so the message echoes the supplied curve string.","triggerScenarios":"nebula-cert ca -curve <value> where <value> is any string other than 25519, X25519, Curve25519, CURVE25519, or P256 — e.g. 'ed25519', 'secp256r1', 'P-256', 'p256' (case-sensitive), or an empty string.","commonSituations":"Typo or wrong casing ('p256' vs 'P256'); using ECDSA-style names ('secp256k1', 'P-384') unsupported by nebula; scripts passing a curve variable that is unset/empty; confusing this path with PKCS#11 mode where only P256 is allowed.","solutions":["Use -curve 25519 or -curve P256 (names are case-sensitive)","Pick P256 if operating under FIPS 140-only mode, since 25519 is rejected there","If PKCS#11 mode is intended, note only -curve P256 is valid there","Check the script/env supplying the curve value for typos or emptiness"],"exampleFix":"// before\nnebula-cert ca -curve p256 -name \"my ca\"\n// after\nnebula-cert ca -curve P256 -name \"my ca\"","handlingStrategy":"validation","validationCode":"validCurves := map[string]bool{\"25519\": true, \"X25519\": true, \"Curve25519\": true, \"CURVE25519\": true, \"P256\": true}\nif !validCurves[curve] {\n\treturn fmt.Errorf(\"unsupported curve %q; use 25519 or P256\", curve)\n}","typeGuard":"func isValidCurve(c string) bool {\n\tswitch c {\n\tcase \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\", \"P256\":\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":null,"preventionTips":["Always pass curve names exactly: 'P256' (capital P) or a 25519 alias","Validate CLI arguments in wrapper scripts before invoking nebula-cert","Remember PKCS#11 mode only accepts P256","Handle unset env/script variables that feed -curve"],"tags":["validation","cli","crypto","curve"],"backgroundTag":"invalid-argument-value","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}