{"record":{"id":"a22c630b3b98b621","repo":"caddyserver/caddy","slug":"unrecognized-key-type-s","errorCode":null,"errorMessage":"unrecognized key type: %s","messagePattern":"unrecognized key type: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/automation.go","lineNumber":282,"sourceCode":"\t}\n\n\treturn nil\n}\n\n// makeCertMagicConfig constructs a certmagic.Config for this policy using the\n// provided issuers and storage. It encapsulates common logic shared between\n// Provision and RebuildCertMagic so we don't duplicate code.\nfunc (ap *AutomationPolicy) makeCertMagicConfig(tlsApp *TLS, issuers []certmagic.Issuer, storage certmagic.Storage) (certmagic.Config, error) {\n\t// key source\n\tkeyType := ap.KeyType\n\tif keyType != \"\" {\n\t\tvar err error\n\t\tkeyType, err = caddy.NewReplacer().ReplaceOrErr(ap.KeyType, true, true)\n\t\tif err != nil {\n\t\t\treturn certmagic.Config{}, fmt.Errorf(\"invalid key type %s: %s\", ap.KeyType, err)\n\t\t}\n\t\tif _, ok := supportedCertKeyTypes[keyType]; !ok {\n\t\t\treturn certmagic.Config{}, fmt.Errorf(\"unrecognized key type: %s\", keyType)\n\t\t}\n\t}\n\tkeySource := certmagic.StandardKeyGenerator{\n\t\tKeyType: supportedCertKeyTypes[keyType],\n\t}\n\n\tif storage == nil {\n\t\tstorage = tlsApp.ctx.Storage()\n\t}\n\n\t// on-demand TLS\n\tvar ond *certmagic.OnDemandConfig\n\tif ap.OnDemand || len(ap.Managers) > 0 {\n\t\t// permission module is now required after a number of negligence cases that allowed abuse;\n\t\t// but it may still be optional for explicit subjects (bounded, non-wildcard), for the\n\t\t// internal issuer since it doesn't cause public PKI pressure on ACME servers; subtly, it\n\t\t// is useful to allow on-demand TLS to be enabled so Managers can be used, but to still\n\t\t// prevent issuance from Issuers (when Managers don't provide a certificate) if there's no","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/automation.go#L264-L300","documentation":"After placeholder expansion, the automation policy's key_type is not one of the supported certificate key types. Caddy's supportedCertKeyTypes map accepts exactly: rsa2048, rsa4096, p256, p384, ed25519. Anything else — including common guesses like 'RSA2048', 'rsa', 'P256', 'ecdsa', or 'ed' — is rejected.","triggerScenarios":"Setting key_type (Caddyfile) or \"key_type\" (JSON) to a string outside the supported set, including wrong casing (matching is case-sensitive) or algorithm-family names like 'ecdsa'/'rsa' without a size.","commonSituations":"Copy-pasting key type names from OpenSSL configs ('RSA-2048') or other servers; assuming case-insensitivity; using 'P256' instead of 'p256'; using 'rsa2048' vs intending 'rsa4096'.","solutions":["Use one of the exact supported values: rsa2048, rsa4096, p256, p384, ed25519 (lowercase).","For ECDSA P-256 (the default) you can simply omit key_type.","Remove any surrounding whitespace or quotes artifacts from the value."],"exampleFix":"# before\nexample.com {\n\ttls {\n\t\tkey_type RSA-2048\n\t}\n}\n\n# after\nexample.com {\n\ttls {\n\t\tkey_type rsa2048\n\t}\n}","handlingStrategy":"type-guard","validationCode":"var allowedKeyTypes = map[string]bool{\"rsa2048\": true, \"rsa4096\": true, \"p256\": true, \"p384\": true, \"ed25519\": true}\nif kt := policy.KeyType; kt != \"\" && !allowedKeyTypes[kt] {\n    return fmt.Errorf(\"key_type %q invalid; want one of rsa2048, rsa4096, p256, p384, ed25519\", kt)\n}","typeGuard":"func isValidKeyType(kt string) bool {\n    switch kt {\n    case \"\", \"rsa2048\", \"rsa4096\", \"p256\", \"p384\", \"ed25519\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Treat the key-type list as an enum in config templating (never free-form).","Remember values are lowercase and case-sensitive.","Omit key_type to accept the sane default."],"tags":["tls","configuration","key-type","validation"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}