{"record":{"id":"8a6efe82a504106c","repo":"dgraph-io/dgraph","slug":"unsupported-key-type-t","errorCode":null,"errorMessage":"Unsupported key type: %T","messagePattern":"Unsupported key type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/create.go","lineNumber":91,"sourceCode":"\t}\n\n\tswitch k := key.(type) {\n\tcase *ecdsa.PrivateKey:\n\t\tb, err := x509.MarshalECPrivateKey(k)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn key, pem.Encode(fp, &pem.Block{\n\t\t\tType:  \"EC PRIVATE KEY\",\n\t\t\tBytes: b,\n\t\t})\n\tcase *rsa.PrivateKey:\n\t\treturn key, pem.Encode(fp, &pem.Block{\n\t\t\tType:  \"RSA PRIVATE KEY\",\n\t\t\tBytes: x509.MarshalPKCS1PrivateKey(k),\n\t\t})\n\t}\n\treturn nil, errors.Errorf(\"Unsupported key type: %T\", key)\n}\n\n// readKey tries to read and decode the contents of a private key file.\n// Returns the private key, or error otherwise.\nfunc readKey(keyFile string) (crypto.PrivateKey, error) {\n\tb, err := os.ReadFile(keyFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, _ := pem.Decode(b)\n\tswitch {\n\tcase block == nil:\n\t\treturn nil, errors.Errorf(\"Failed to read key block\")\n\tcase block.Type == \"EC PRIVATE KEY\":\n\t\treturn x509.ParseECPrivateKey(block.Bytes)\n\tcase block.Type == \"RSA PRIVATE KEY\":\n\t\treturn x509.ParsePKCS1PrivateKey(block.Bytes)","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/create.go#L73-L109","documentation":"makeKey (dgraph/cmd/cert/create.go:91) returns this error when the generated crypto.PrivateKey is neither *ecdsa.PrivateKey nor *rsa.PrivateKey. In practice generateKey only ever produces those two types (rsa for empty --key_type, ECDSA for P224-P521), so this is a defensive guard against a future/unsupported key type or a nil key from a failed generation path.","triggerScenarios":"Calling makeKey with a key generated from an unsupported --key_type value that leaves `key` as nil or an unhandled type, i.e. any code path where the type switch at create.go:75 falls through; for library users, passing a custom crypto.Signer-backed private key type.","commonSituations":"Passing an invalid --key_type (e.g. typo like \"P-256\" or \"ED25519\") to `dgraph cert`, which matches no case in generateKey and falls through to this guard; porting the tool to a key algorithm it doesn't support.","solutions":["Use a supported --key_type value: empty (RSA), P224, P256, P384, or P521.","Ensure the type switch in makeKey covers every key type generateKey can return; add the missing case if a new algorithm was introduced.","Handle the returned error rather than ignoring it, so the failure surfaces at generation time instead of a nil key later."],"exampleFix":"// before: unsupported algorithm\ndgraph cert --ca --key_type ED25519\n// after: use a supported curve\ndgraph cert --ca --key_type P256","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"\": true, \"P224\": true, \"P256\": true, \"P384\": true, \"P521\": true}\nif !allowed[*keyType] {\n    return fmt.Errorf(\"unsupported --key_type %q; use one of: P224, P256, P384, P521\", *keyType)\n}","typeGuard":"func isSupportedPrivateKey(key crypto.PrivateKey) bool {\n    switch key.(type) {\n    case *ecdsa.PrivateKey, *rsa.PrivateKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":"key, err := makeKey(fp, cfg)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"Unsupported key type\") {\n        return fmt.Errorf(\"fallback to default RSA key type: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate --key_type against the supported list before invoking dgraph cert.","Note the tool generates RSA when --key_type is empty; omit the flag unless you need EC.","If extending the tool to new algorithms, add matching cases in both generateKey and makeKey.","Prefer P256 for ECDSA — it is the most widely supported curve in the tool."],"tags":["go","crypto","key-generation","unsupported-type"],"backgroundTag":"unsupported-key-type","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}