What causes "Unknown private key type: %T" in dgraph-io/dgraph?

Regenerate the key with `dgraph cert create` so it is RSA or ECDSA

Unknown private key type: %T

Error message

Unknown private key type: %T

What it means

After successfully reading a private key, getFileInfo asserts it implements crypto.Signer. If the parsed key type does not, it records 'Unknown private key type: %T' with the concrete Go type. Note the message formats `key` (nil after the failed assertion), so the %T prints <nil> — the real cause is that readKey returned an unsupported key type.

Source

Thrown at dgraph/cmd/cert/info.go:117

		case file == defaultNodeKey:
			info.commonName = dnCommonNamePrefix + " Node key"

		case strings.HasPrefix(file, "client."):
			info.commonName = dnCommonNamePrefix + " Client key"

		default:
			info.err = errors.Errorf("Unsupported key")
			return &info
		}

		priv, err := readKey(file)
		if err != nil {
			info.err = err
			return &info
		}
		key, ok := priv.(crypto.Signer)
		if !ok {
			info.err = errors.Errorf("Unknown private key type: %T", key)
		}
		switch k := key.(type) {
		case *ecdsa.PrivateKey:
			info.algo = fmt.Sprintf("ECDSA %s (FIPS-3)", k.PublicKey.Curve.Params().Name)
			info.digest = getHexDigest(elliptic.Marshal(k.PublicKey.Curve,
				k.PublicKey.X, k.PublicKey.Y))
		case *rsa.PrivateKey:
			info.algo = fmt.Sprintf("RSA %d bits (PKCS#1)", k.PublicKey.N.BitLen())
			info.digest = getHexDigest(k.PublicKey.N.Bytes())
		}

	default:
		info.err = errors.Errorf("Unsupported file")
	}

	return &info
}

View on GitHub (pinned to 759e242be6)

Solutions

Regenerate the key with `dgraph cert create` so it is RSA or ECDSA
Convert the key to RSA/ECDSA with openssl (e.g. openssl ecparam -genkey -name prime256v1) before placing it in the TLS dir
Inspect the key type with `openssl pkey -in <file> -text -noout` to confirm the algorithm

Defensive patterns

Strategy: type-guard

Validate before calling

func isSupportedKeyAlgo(pemFile string) error {
    out, err := exec.Command("openssl", "pkey", "-in", pemFile, "-noout", "-text").Output()
    if err != nil { return err }
    s := string(out)
    if !strings.Contains(s, "Private-Key") { return fmt.Errorf("not a private key file") }
    // ensure RSA or EC, not Ed25519/DSA
    return nil
}

Type guard

func asSigner(priv crypto.PrivateKey) (crypto.Signer, bool) {
    s, ok := priv.(crypto.Signer)
    if !ok { return nil, false }
    switch s.(type) {
    case *ecdsa.PrivateKey, *rsa.PrivateKey:
        return s, true
    }
    return nil, false
}

Prevention

Only use RSA or ECDSA keys with dgraph (avoid Ed25519/DSA)
Generate keys with dgraph cert create or convert with openssl first
Inspect unknown keys with `openssl pkey -text -noout` before installing them

When it happens

Trigger: A key file in the TLS directory decodes to a crypto.PrivateKey that is not *ecdsa.PrivateKey or *rsa.PrivateKey and does not implement crypto.Signer — e.g. an Ed25519 PKCS#8 key parsed into a type the code doesn't handle, or a malformed PEM decoded as an unexpected type.

Common situations: Using keys generated by external tools with algorithm types outside dgraph cert's supported set (Ed25519, DSA), or encrypted/oddly encoded PEM files.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/bc7f9b0f4a63a342. Report an issue: GitHub.