dgraph-io/dgraph · error

Key size value must be a factor of 2

Error message

Key size value must be a factor of 2

What it means

createCerts requires the RSA key size to be an even number (a factor of 2), since RSA and crypto libraries only support even bit lengths. An odd --keysize value (e.g. 2047) fails this modulo check and certificate generation aborts.

Source

Thrown at dgraph/cmd/cert/create.go:262

		return errors.New("nil options")
	}

	if opt.dir == "" {
		return errors.New("Invalid TLS directory")
	}

	err := os.Mkdir(opt.dir, 0700)
	if err != nil && !os.IsExist(err) {
		return err
	}

	switch {
	case opt.keySize < keySizeTooSmall:
		return errors.New("Key size value is too small (x < 512)")
	case opt.keySize > keySizeTooLarge:
		return errors.New("Key size value is too large (x > 4096)")
	case opt.keySize%2 != 0:
		return errors.New("Key size value must be a factor of 2")
	}

	switch opt.curve {
	case "":
	case "P224", "P256", "P384", "P521":
	default:
		return errors.New(`Elliptic curve value must be one of: P224, P256, P384 or P521`)
	}

	// no path then save it in certsDir.
	if filepath.Base(opt.caKey) == opt.caKey {
		opt.caKey = filepath.Join(opt.dir, opt.caKey)
	}
	opt.caCert = filepath.Join(opt.dir, defaultCACert)

	if err := createCAPair(opt); err != nil {
		return err
	}

View on GitHub (pinned to 759e242be6)

Solutions

1. Round the key size to the nearest even value, e.g. 2048 instead of 2047
2. Prefer standard sizes: 512/1024/2048/4096
3. Validate the flag value in any wrapper script before invoking dgraph cert create

Example fix

// before
dgraph cert create --keysize 2049
// after
dgraph cert create --keysize 2048

func validateKeySizeEven(n int) error {
    if n%2 != 0 { return fmt.Errorf("key size %d must be even", n) }
    return nil
}

When it happens

Trigger: Running `dgraph cert create --keysize N` where N is odd (N%2 != 0), e.g. --keysize 2049 or --keysize 1025.

Common situations: Typo in the key size flag, off-by-one manual adjustments ('one more bit'), or scripted values computed dynamically that land on an odd number.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

• Key size value is too large (x > 4096)
• Elliptic curve value must be one of: P224, P256, P384 or P52
• Unsupported certificate
• Unsupported file
• error: `%s` must be less than `%s`

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/fc67dc9647ca2c43. Report an issue: GitHub.