What causes "Unsupported key type: %T" in dgraph-io/dgraph?

Use a supported --key_type value: empty (RSA), P224, P256, P384, or P521.

Unsupported key type: %T

Error message

Unsupported key type: %T

What it means

makeKey (dgraph/cmd/cert/create.go:91) returns this error when the generated crypto.PrivateKey is neither *ecdsa.PrivateKey nor *rsa.PrivateKey. In practice generateKey only ever produces those two types (rsa for empty --key_type, ECDSA for P224-P521), so this is a defensive guard against a future/unsupported key type or a nil key from a failed generation path.

Source

Thrown at dgraph/cmd/cert/create.go:91

	}

	switch k := key.(type) {
	case *ecdsa.PrivateKey:
		b, err := x509.MarshalECPrivateKey(k)
		if err != nil {
			return nil, err
		}
		return key, pem.Encode(fp, &pem.Block{
			Type:  "EC PRIVATE KEY",
			Bytes: b,
		})
	case *rsa.PrivateKey:
		return key, pem.Encode(fp, &pem.Block{
			Type:  "RSA PRIVATE KEY",
			Bytes: x509.MarshalPKCS1PrivateKey(k),
		})
	}
	return nil, errors.Errorf("Unsupported key type: %T", key)
}

// readKey tries to read and decode the contents of a private key file.
// Returns the private key, or error otherwise.
func readKey(keyFile string) (crypto.PrivateKey, error) {
	b, err := os.ReadFile(keyFile)
	if err != nil {
		return nil, err
	}

	block, _ := pem.Decode(b)
	switch {
	case block == nil:
		return nil, errors.Errorf("Failed to read key block")
	case block.Type == "EC PRIVATE KEY":
		return x509.ParseECPrivateKey(block.Bytes)
	case block.Type == "RSA PRIVATE KEY":
		return x509.ParsePKCS1PrivateKey(block.Bytes)

View on GitHub (pinned to 759e242be6)

Solutions

Use a supported --key_type value: empty (RSA), P224, P256, P384, or P521.
Ensure the type switch in makeKey covers every key type generateKey can return; add the missing case if a new algorithm was introduced.
Handle the returned error rather than ignoring it, so the failure surfaces at generation time instead of a nil key later.

Example fix

// before: unsupported algorithm
dgraph cert --ca --key_type ED25519
// after: use a supported curve
dgraph cert --ca --key_type P256

Defensive patterns

Strategy: validation

Validate before calling

allowed := map[string]bool{"": true, "P224": true, "P256": true, "P384": true, "P521": true}
if !allowed[*keyType] {
    return fmt.Errorf("unsupported --key_type %q; use one of: P224, P256, P384, P521", *keyType)
}

Type guard

func isSupportedPrivateKey(key crypto.PrivateKey) bool {
    switch key.(type) {
    case *ecdsa.PrivateKey, *rsa.PrivateKey:
        return true
    }
    return false
}

Try / catch

key, err := makeKey(fp, cfg)
if err != nil {
    if strings.HasPrefix(err.Error(), "Unsupported key type") {
        return fmt.Errorf("fallback to default RSA key type: %w", err)
    }
    return err
}

Prevention

Validate --key_type against the supported list before invoking dgraph cert.
Note the tool generates RSA when --key_type is empty; omit the flag unless you need EC.
If extending the tool to new algorithms, add matching cases in both generateKey and makeKey.
Prefer P256 for ECDSA — it is the most widely supported curve in the tool.

When it happens

Trigger: Calling makeKey with a key generated from an unsupported --key_type value that leaves `key` as nil or an unhandled type, i.e. any code path where the type switch at create.go:75 falls through; for library users, passing a custom crypto.Signer-backed private key type.

Common situations: Passing an invalid --key_type (e.g. typo like "P-256" or "ED25519") to `dgraph cert`, which matches no case in generateKey and falls through to this guard; porting the tool to a key algorithm it doesn't support.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/8a6efe82a504106c. Report an issue: GitHub.