{"record":{"id":"fc67dc9647ca2c43","repo":"dgraph-io/dgraph","slug":"key-size-value-must-be-a-factor-of-2","errorCode":null,"errorMessage":"Key size value must be a factor of 2","messagePattern":"Key size value must be a factor of 2","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/create.go","lineNumber":262,"sourceCode":"\t\treturn errors.New(\"nil options\")\n\t}\n\n\tif opt.dir == \"\" {\n\t\treturn errors.New(\"Invalid TLS directory\")\n\t}\n\n\terr := os.Mkdir(opt.dir, 0700)\n\tif err != nil && !os.IsExist(err) {\n\t\treturn err\n\t}\n\n\tswitch {\n\tcase opt.keySize < keySizeTooSmall:\n\t\treturn errors.New(\"Key size value is too small (x < 512)\")\n\tcase opt.keySize > keySizeTooLarge:\n\t\treturn errors.New(\"Key size value is too large (x > 4096)\")\n\tcase opt.keySize%2 != 0:\n\t\treturn errors.New(\"Key size value must be a factor of 2\")\n\t}\n\n\tswitch opt.curve {\n\tcase \"\":\n\tcase \"P224\", \"P256\", \"P384\", \"P521\":\n\tdefault:\n\t\treturn errors.New(`Elliptic curve value must be one of: P224, P256, P384 or P521`)\n\t}\n\n\t// no path then save it in certsDir.\n\tif filepath.Base(opt.caKey) == opt.caKey {\n\t\topt.caKey = filepath.Join(opt.dir, opt.caKey)\n\t}\n\topt.caCert = filepath.Join(opt.dir, defaultCACert)\n\n\tif err := createCAPair(opt); err != nil {\n\t\treturn err\n\t}","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/create.go#L244-L280","documentation":"createCerts requires the RSA key size to be an even number (a factor of 2), since RSA and crypto libraries only support even bit lengths. An odd --keysize value (e.g. 2047) fails this modulo check and certificate generation aborts.","triggerScenarios":"Running `dgraph cert create --keysize N` where N is odd (N%2 != 0), e.g. --keysize 2049 or --keysize 1025.","commonSituations":"Typo in the key size flag, off-by-one manual adjustments ('one more bit'), or scripted values computed dynamically that land on an odd number.","solutions":["Round the key size to the nearest even value, e.g. 2048 instead of 2047","Prefer standard sizes: 512/1024/2048/4096","Validate the flag value in any wrapper script before invoking dgraph cert create"],"exampleFix":"// before\ndgraph cert create --keysize 2049\n// after\ndgraph cert create --keysize 2048","handlingStrategy":"validation","validationCode":"func validateKeySizeEven(n int) error {\n    if n%2 != 0 { return fmt.Errorf(\"key size %d must be even\", n) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Round any computed key size down to an even value before use","Stick to well-known sizes (512/1024/2048/4096) in scripts and docs","Never hand-adjust a key size by ±1 bit"],"tags":["cli","tls","validation"],"backgroundTag":"invalid-flag-value","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}