dgraph-io/dgraph · error

Key size value must be a factor of 2

Error message

Key size value must be a factor of 2

What it means

createCerts requires the RSA key size to be an even number (a factor of 2), since RSA and crypto libraries only support even bit lengths. An odd --keysize value (e.g. 2047) fails this modulo check and certificate generation aborts.

Solutions

1. Round the key size to the nearest even value, e.g. 2048 instead of 2047
2. Prefer standard sizes: 512/1024/2048/4096
3. Validate the flag value in any wrapper script before invoking dgraph cert create

Example fix

// before
dgraph cert create --keysize 2049
// after
dgraph cert create --keysize 2048

func validateKeySizeEven(n int) error {
    if n%2 != 0 { return fmt.Errorf("key size %d must be even", n) }
    return nil
}

When it happens

Trigger: Running `dgraph cert create --keysize N` where N is odd (N%2 != 0), e.g. --keysize 2049 or --keysize 1025.

Common situations: Typo in the key size flag, off-by-one manual adjustments ('one more bit'), or scripted values computed dynamically that land on an odd number.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

• Elliptic curve value must be one of: P224, P256, P384 or…
• Key size value is too large (x > 4096)
• error: ` ` must be less than
• Unsupported certificate
• Unsupported file

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/fc67dc9647ca2c43. Report an issue: GitHub.

Appendix: source

Thrown at dgraph/cmd/cert/create.go:262

		return errors.New("nil options")
	}

	if opt.dir == "" {
		return errors.New("Invalid TLS directory")
	}

	err := os.Mkdir(opt.dir, 0700)
	if err != nil && !os.IsExist(err) {
		return err
	}

	switch {
	case opt.keySize < keySizeTooSmall:
		return errors.New("Key size value is too small (x < 512)")
	case opt.keySize > keySizeTooLarge:
		return errors.New("Key size value is too large (x > 4096)")
	case opt.keySize%2 != 0:
		return errors.New("Key size value must be a factor of 2")
	}

	switch opt.curve {
	case "":
	case "P224", "P256", "P384", "P521":
	default:
		return errors.New(`Elliptic curve value must be one of: P224, P256, P384 or P521`)
	}

	// no path then save it in certsDir.
	if filepath.Base(opt.caKey) == opt.caKey {
		opt.caKey = filepath.Join(opt.dir, opt.caKey)
	}
	opt.caCert = filepath.Join(opt.dir, defaultCACert)

	if err := createCAPair(opt); err != nil {
		return err
	}

View on GitHub (pinned to 759e242be6)