dgraph-io/dgraph · info

Unsupported file

Error message

Unsupported file

What it means

The outermost default case of getFileInfo handles files that are neither certificates nor keys. Any file in the TLS directory that isn't named like a cert or key lands here and gets 'Unsupported file' recorded in info.err.

Source

Thrown at dgraph/cmd/cert/info.go:130

			info.err = err
			return &info
		}
		key, ok := priv.(crypto.Signer)
		if !ok {
			info.err = errors.Errorf("Unknown private key type: %T", key)
		}
		switch k := key.(type) {
		case *ecdsa.PrivateKey:
			info.algo = fmt.Sprintf("ECDSA %s (FIPS-3)", k.PublicKey.Curve.Params().Name)
			info.digest = getHexDigest(elliptic.Marshal(k.PublicKey.Curve,
				k.PublicKey.X, k.PublicKey.Y))
		case *rsa.PrivateKey:
			info.algo = fmt.Sprintf("RSA %d bits (PKCS#1)", k.PublicKey.N.BitLen())
			info.digest = getHexDigest(k.PublicKey.N.Bytes())
		}

	default:
		info.err = errors.Errorf("Unsupported file")
	}

	return &info
}

// getHexDigest returns a SHA-256 hex digest broken up into 32-bit chunks
// so that they easier to compare visually
// e.g. 4A2B0F0F 716BF5B6 C603E01A 6229D681 0B2AFDC5 CADF5A0D 17D59299 116119E5
func getHexDigest(data []byte) string {
	const groupSizeBytes = 4

	digest := sha256.Sum256(data)
	groups := len(digest) / groupSizeBytes
	hex := fmt.Sprintf("%0*X", groupSizeBytes*2, digest[0:groupSizeBytes])
	for i := 1; i < groups; i++ {
		hex += fmt.Sprintf(" %0*X", groupSizeBytes*2,
			digest[i*groupSizeBytes:(i+1)*groupSizeBytes])
	}

View on GitHub (pinned to 759e242be6)

Solutions

1. Remove or move non-cert/key files out of the TLS directory
2. Point `dgraph cert info --dir` at the directory created by `dgraph cert create`
3. Rename files to dgraph's expected scheme if they are genuinely certs/keys (see error 63/65)

Example fix

// before
tls/: ca.crt ca.key ca.csr ca.srl notes.txt
dgraph cert info  # ca.csr etc -> Unsupported file
// after
mv tls/ca.csr tls/ca.srl tls/notes.txt /tmp/backup/  # rerun dgraph cert info

func isSupportedFileName(name string) bool {
    if name == "ca.crt" || name == "ca.key" { return true }
    certPrefix := strings.HasPrefix(name, "node.") || strings.HasPrefix(name, "client.")
    isCert := strings.HasSuffix(name, ".crt")
    isKey := strings.HasSuffix(name, ".key")
    return certPrefix && (isCert || isKey)
}

When it happens

Trigger: Running `dgraph cert info` when the directory contains files that are not ca.crt/node.crt/client.*.crt certs nor ca.key/node.key/client.*.key files — e.g. CSRs, .pem bundles, README files, or index/serial files.

Common situations: Pointing --dir at the wrong folder, leftover files from external PKI tooling (requests/, serial, index.txt), or .srl/.csr files generated during manual CA work.

Related errors

• Key size value is too large (x > 4096)
• Key size value must be a factor of 2
• Elliptic curve value must be one of: P224, P256, P384 or P52
• Unsupported certificate
• %s: verification failed

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/6fae01179002ea0b. Report an issue: GitHub.