dgraph-io/dgraph · warning

Unsupported certificate

Error message

Unsupported certificate

What it means

When running `dgraph cert info`, getFileInfo classifies each file in the TLS directory by filename prefix (ca.crt, node., client.) to build its info record. A file whose name matches none of the known patterns is flagged 'Unsupported certificate'. It is a per-file error stored in info.err rather than a fatal abort.

Source

Thrown at dgraph/cmd/cert/info.go:69

		info.commonName = cert.Subject.CommonName + " certificate"
		info.issuerName = strings.Join(cert.Issuer.Organization, ", ")
		info.serialNumber = hex.EncodeToString(cert.SerialNumber.Bytes())
		info.expireDate = cert.NotAfter

		switch {
		case file == defaultCACert:
		case file == defaultNodeCert:
			for _, ip := range cert.IPAddresses {
				info.hosts = append(info.hosts, ip.String())
			}
			info.hosts = append(info.hosts, cert.DNSNames...)

		case strings.HasPrefix(file, "client."):
			info.commonName = fmt.Sprintf("%s client certificate: %s",
				dnCommonNamePrefix, cert.Subject.CommonName)

		default:
			info.err = errors.Errorf("Unsupported certificate")
			return &info
		}

		switch key := cert.PublicKey.(type) {
		case *rsa.PublicKey:
			info.digest = getHexDigest(key.N.Bytes())
		case *ecdsa.PublicKey:
			info.digest = getHexDigest(elliptic.Marshal(key.Curve, key.X, key.Y))
		default:
			info.digest = "Invalid public key"
		}

		if file != defaultCACert {
			parent, err := readCert(defaultCACert)
			if err != nil {
				info.err = errors.Wrapf(err, "could not read parent cert")
				return &info
			}

View on GitHub (pinned to 759e242be6)

Solutions

1. Rename the certificate to a supported prefix: ca.crt, node.crt, or client.<name>.crt
2. Move unrelated certificates out of the TLS directory before running dgraph cert info
3. Regenerate certificates with `dgraph cert create` so files follow dgraph's naming scheme

Example fix

// before
ls tls: server.crt  ca.crt
dgraph cert info --dir tls  # server.crt -> Unsupported certificate
// after
mv tls/server.crt tls/client.server.crt  # or node.crt, then rerun dgraph cert info

func isSupportedCertName(name string) bool {
    return name == "ca.crt" || strings.HasPrefix(name, "node.") || strings.HasPrefix(name, "client.")
}
// before running dgraph cert info, ensure every *.crt file passes isSupportedCertName

When it happens

Trigger: Running `dgraph cert info` in a directory containing a certificate file that does not start with 'ca', 'node', or 'client' (e.g. a manually copied server.crt or a backup copy like ca-old.crt).

Common situations: Users copying external certs into the dgraph TLS dir, renaming files, keeping rotated/backup certs, or certificates generated by other tools with different naming conventions.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Key size value is too large (x > 4096)
• Key size value must be a factor of 2
• Elliptic curve value must be one of: P224, P256, P384 or P52
• Unsupported key
• Unsupported file

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/11e1bcee72f47950. Report an issue: GitHub.