Elliptic curve value must be one of: P224, P256, P384 or P52

Error message

Elliptic curve value must be one of: P224, P256, P384 or P521

What it means

When --curve is specified for dgraph cert create, it must be one of the supported elliptic curves: P224, P256, P384 or P521. An empty string means 'use RSA with --keysize'; any other non-empty value hits the default case and is rejected.

Source

Thrown at dgraph/cmd/cert/create.go:269

	err := os.Mkdir(opt.dir, 0700)
	if err != nil && !os.IsExist(err) {
		return err
	}

	switch {
	case opt.keySize < keySizeTooSmall:
		return errors.New("Key size value is too small (x < 512)")
	case opt.keySize > keySizeTooLarge:
		return errors.New("Key size value is too large (x > 4096)")
	case opt.keySize%2 != 0:
		return errors.New("Key size value must be a factor of 2")
	}

	switch opt.curve {
	case "":
	case "P224", "P256", "P384", "P521":
	default:
		return errors.New(`Elliptic curve value must be one of: P224, P256, P384 or P521`)
	}

	// no path then save it in certsDir.
	if filepath.Base(opt.caKey) == opt.caKey {
		opt.caKey = filepath.Join(opt.dir, opt.caKey)
	}
	opt.caCert = filepath.Join(opt.dir, defaultCACert)

	if err := createCAPair(opt); err != nil {
		return err
	}
	if err := createNodePair(opt); err != nil {
		return err
	}
	return createClientPair(opt)
}

View on GitHub (pinned to 759e242be6)

Solutions

Use the exact supported names: P224, P256, P384, or P521 (case-sensitive, no hyphen)
Run `dgraph cert create --help` to see the accepted curve values
If a different curve is required, generate certificates with an external tool (e.g. openssl or cfssl) and point dgraph at them

Example fix

// before
dgraph cert create --curve p-256
// after
dgraph cert create --curve P256

Defensive patterns

Strategy: validation

Validate before calling

var validCurves = map[string]bool{"P224": true, "P256": true, "P384": true, "P521": true}
func validateCurve(c string) error {
    if c == "" || validCurves[c] { return nil }
    return fmt.Errorf("curve %q not supported; use P224, P256, P384 or P521", c)
}

Prevention

Use exact Go-style curve names (P256, not p-256/prime256v1/secp256r1)
Check `dgraph cert create --help` for accepted values
For other curves, generate certs externally and import them

When it happens

Trigger: Running `dgraph cert create --curve <name>` where <name> is not exactly P224, P256, P384 or P521 — e.g. --curve p256 (lowercase), --curve P-256, --curve secp256r1, or --curve Ed25519.

Common situations: Copying curve names from OpenSSL or Go docs that use different naming (P-256, prime256v1), lowercase names from other tools, or attempting modern curves like Ed25519 that dgraph cert does not support.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/4213417d43bd1d97. Report an issue: GitHub.