dgraph-io/dgraph · warning

Unsupported key

Error message

Unsupported key

What it means

The key-inspection branch of getFileInfo classifies private key files by name prefix (node., client., ca.key). A key file with an unrecognized name gets 'Unsupported key' recorded in info.err and is skipped rather than analyzed.

Source

Thrown at dgraph/cmd/cert/info.go:106

			info.verifiedCA = "FAILED"
			if err := cert.CheckSignatureFrom(parent); err == nil {
				info.verifiedCA = "PASSED"
			}
		}

	case strings.HasSuffix(file, ".key"):
		switch {
		case file == defaultCAKey:
			info.commonName = dnCommonNamePrefix + " Root CA key"

		case file == defaultNodeKey:
			info.commonName = dnCommonNamePrefix + " Node key"

		case strings.HasPrefix(file, "client."):
			info.commonName = dnCommonNamePrefix + " Client key"

		default:
			info.err = errors.Errorf("Unsupported key")
			return &info
		}

		priv, err := readKey(file)
		if err != nil {
			info.err = err
			return &info
		}
		key, ok := priv.(crypto.Signer)
		if !ok {
			info.err = errors.Errorf("Unknown private key type: %T", key)
		}
		switch k := key.(type) {
		case *ecdsa.PrivateKey:
			info.algo = fmt.Sprintf("ECDSA %s (FIPS-3)", k.PublicKey.Curve.Params().Name)
			info.digest = getHexDigest(elliptic.Marshal(k.PublicKey.Curve,
				k.PublicKey.X, k.PublicKey.Y))
		case *rsa.PrivateKey:

View on GitHub (pinned to 759e242be6)

Solutions

1. Rename the key to a supported name: ca.key, node.key, or client.<name>.key
2. Remove unrelated key files from the TLS directory
3. Regenerate the key pair with `dgraph cert create` so naming matches

Example fix

// before
tls/: server.key ...
dgraph cert info  # server.key -> Unsupported key
// after
mv tls/server.key tls/node.key  # then rerun dgraph cert info

func isSupportedKeyName(name string) bool {
    return name == "ca.key" || strings.HasPrefix(name, "node.") || strings.HasPrefix(name, "client.")
}

When it happens

Trigger: Running `dgraph cert info` in a directory containing a private key file not named ca.key, node.key, or client.<name>.key (e.g. server.key or a backup old.key).

Common situations: Manually generated keys copied into the TLS dir, renamed/backup keys, or output from external tooling (openssl genrsa) using different naming.

Related errors

• Unsupported certificate
• Unknown private key type: %T
• %s: verification failed
• Failed to read key block
• Unknown PEM type: %s

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/5e86a2cdacca025b. Report an issue: GitHub.