{"record":{"id":"bc7f9b0f4a63a342","repo":"dgraph-io/dgraph","slug":"unknown-private-key-type-t","errorCode":null,"errorMessage":"Unknown private key type: %T","messagePattern":"Unknown private key type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/info.go","lineNumber":117,"sourceCode":"\t\tcase file == defaultNodeKey:\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Node key\"\n\n\t\tcase strings.HasPrefix(file, \"client.\"):\n\t\t\tinfo.commonName = dnCommonNamePrefix + \" Client key\"\n\n\t\tdefault:\n\t\t\tinfo.err = errors.Errorf(\"Unsupported key\")\n\t\t\treturn &info\n\t\t}\n\n\t\tpriv, err := readKey(file)\n\t\tif err != nil {\n\t\t\tinfo.err = err\n\t\t\treturn &info\n\t\t}\n\t\tkey, ok := priv.(crypto.Signer)\n\t\tif !ok {\n\t\t\tinfo.err = errors.Errorf(\"Unknown private key type: %T\", key)\n\t\t}\n\t\tswitch k := key.(type) {\n\t\tcase *ecdsa.PrivateKey:\n\t\t\tinfo.algo = fmt.Sprintf(\"ECDSA %s (FIPS-3)\", k.PublicKey.Curve.Params().Name)\n\t\t\tinfo.digest = getHexDigest(elliptic.Marshal(k.PublicKey.Curve,\n\t\t\t\tk.PublicKey.X, k.PublicKey.Y))\n\t\tcase *rsa.PrivateKey:\n\t\t\tinfo.algo = fmt.Sprintf(\"RSA %d bits (PKCS#1)\", k.PublicKey.N.BitLen())\n\t\t\tinfo.digest = getHexDigest(k.PublicKey.N.Bytes())\n\t\t}\n\n\tdefault:\n\t\tinfo.err = errors.Errorf(\"Unsupported file\")\n\t}\n\n\treturn &info\n}\n","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/info.go#L99-L135","documentation":"After successfully reading a private key, getFileInfo asserts it implements crypto.Signer. If the parsed key type does not, it records 'Unknown private key type: %T' with the concrete Go type. Note the message formats `key` (nil after the failed assertion), so the %T prints <nil> — the real cause is that readKey returned an unsupported key type.","triggerScenarios":"A key file in the TLS directory decodes to a crypto.PrivateKey that is not *ecdsa.PrivateKey or *rsa.PrivateKey and does not implement crypto.Signer — e.g. an Ed25519 PKCS#8 key parsed into a type the code doesn't handle, or a malformed PEM decoded as an unexpected type.","commonSituations":"Using keys generated by external tools with algorithm types outside dgraph cert's supported set (Ed25519, DSA), or encrypted/oddly encoded PEM files.","solutions":["Regenerate the key with `dgraph cert create` so it is RSA or ECDSA","Convert the key to RSA/ECDSA with openssl (e.g. openssl ecparam -genkey -name prime256v1) before placing it in the TLS dir","Inspect the key type with `openssl pkey -in <file> -text -noout` to confirm the algorithm"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"func isSupportedKeyAlgo(pemFile string) error {\n    out, err := exec.Command(\"openssl\", \"pkey\", \"-in\", pemFile, \"-noout\", \"-text\").Output()\n    if err != nil { return err }\n    s := string(out)\n    if !strings.Contains(s, \"Private-Key\") { return fmt.Errorf(\"not a private key file\") }\n    // ensure RSA or EC, not Ed25519/DSA\n    return nil\n}","typeGuard":"func asSigner(priv crypto.PrivateKey) (crypto.Signer, bool) {\n    s, ok := priv.(crypto.Signer)\n    if !ok { return nil, false }\n    switch s.(type) {\n    case *ecdsa.PrivateKey, *rsa.PrivateKey:\n        return s, true\n    }\n    return nil, false\n}","tryCatchPattern":null,"preventionTips":["Only use RSA or ECDSA keys with dgraph (avoid Ed25519/DSA)","Generate keys with dgraph cert create or convert with openssl first","Inspect unknown keys with `openssl pkey -text -noout` before installing them"],"tags":["tls","keys","crypto","unsupported-algorithm"],"backgroundTag":"unsupported-key-type","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}