{"record":{"id":"d44a52c0e514507f","repo":"slackhq/nebula","slug":"invalid-curve-s-d44a52","errorCode":null,"errorMessage":"invalid curve: %s","messagePattern":"invalid curve: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/keygen.go","lineNumber":75,"sourceCode":"\t\tswitch *cf.curve {\n\t\tcase \"P256\":\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve for PKCS#11: %s\", *cf.curve)\n\t\t}\n\t} else {\n\t\tswitch *cf.curve {\n\t\tcase \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\":\n\t\t\tif fips140.Enforced() {\n\t\t\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t\t\t}\n\t\t\tpub, rawPriv = x25519Keypair()\n\t\t\tcurve = cert.Curve_CURVE25519\n\t\tcase \"P256\":\n\t\t\tpub, rawPriv = p256Keypair()\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve: %s\", *cf.curve)\n\t\t}\n\t}\n\n\tvar claims ioClaims\n\tif err := reserveOutputs(&claims,\n\t\t\"out-key\", *cf.outKeyPath,\n\t\t\"out-pub\", *cf.outPubPath,\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tif isP11 {\n\t\tp11Client, err := pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/keygen.go#L57-L93","documentation":"nebula-cert key generation rejected the -curve flag value: in non-PKCS#11 mode only 25519, X25519, Curve25519, CURVE25519 and P256 are accepted. Any other string returns this error before generating a keypair.","triggerScenarios":"Running `nebula-cert keygen` (or `ca`-adjacent keygen flow) with -curve set to an unrecognized string such as \"p-256\" (lowercase), \"ed25519\", \"RSA\", or a typo like \"Curve2559\".","commonSituations":"Case/normalization mistakes (\"p256\" vs \"P256\"); copying curve names from other tools (openssl \"prime256v1\"); typos in automation scripts.","solutions":["Use exactly \"P256\" or one of \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\".","Remove the -curve flag entirely to use the default curve.","Fix case sensitivity — \"p256\" lowercase is not accepted.","Check the script/config for copied OpenSSL-style curve names and translate them."],"exampleFix":"// before\nnebula-cert keygen -curve p256 -out-key host.key -out-pub host.pub\n// after\nnebula-cert keygen -curve P256 -out-key host.key -out-pub host.pub","handlingStrategy":"validation","validationCode":"#!/bin/sh\ncase \"$CURVE\" in\n  25519|X25519|Curve25519|CURVE25519|P256) ;;\n  *) echo \"invalid -curve '$CURVE': use 25519 or P256\" >&2; exit 1 ;;\nesac","typeGuard":"var validCurves = map[string]bool{\n    \"25519\": true, \"X25519\": true, \"Curve25519\": true, \"CURVE25519\": true, \"P256\": true,\n}\n\nfunc validCurve(curve string) bool { return validCurves[curve] }","tryCatchPattern":null,"preventionTips":["Use the exact accepted strings: 25519/X25519/Curve25519/CURVE25519 or P256 (case-sensitive).","Omit -curve to accept the default.","Translate OpenSSL-style curve names before passing them to nebula-cert."],"tags":["curve","cli","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}