What causes "unrecognized curve preference %s" in nats-io/nats-server?

Use a recognized name from curvePreferenceMap, e.g. 'CurveP256', 'CurveP384', 'CurveP521', 'X25519'

unrecognized curve preference %s

Error message

unrecognized curve preference %s

What it means

parseCurvePreferences looks up the elliptic-curve name in curvePreferenceMap and returns this error when the name is unknown. The server cannot map the given string to a tls.CurveID for TLS ECDHE curve preferences.

Source

Thrown at server/opts.go:5101

		fmt.Printf("%s\n", certstore.Usage)
	}
	fmt.Printf("%s", certidp.OCSPPeerUsage)
	fmt.Printf("%s", OCSPResponseCacheUsage)
	os.Exit(0)
}

func parseCipher(cipherName string) (*tls.CipherSuite, error) {
	cipher, exists := cipherMap[cipherName]
	if !exists {
		return nil, fmt.Errorf("unrecognized cipher %s", cipherName)
	}
	return cipher, nil
}

func parseCurvePreferences(curveName string) (tls.CurveID, error) {
	curve, exists := curvePreferenceMap[curveName]
	if !exists {
		return 0, fmt.Errorf("unrecognized curve preference %s", curveName)
	}
	return curve, nil
}

func parseTLSVersion(v any) (uint16, error) {
	var tlsVersionNumber uint16
	switch v := v.(type) {
	case string:
		n, err := tlsVersionFromString(v)
		if err != nil {
			return 0, err
		}
		tlsVersionNumber = n
	default:
		return 0, fmt.Errorf("'min_version' wrong type: %v", v)
	}
	if tlsVersionNumber < tls.VersionTLS12 {
		return 0, fmt.Errorf("unsupported TLS version: %s", tls.VersionName(tlsVersionNumber))

View on GitHub (pinned to 3a66a489d2)

Solutions

Use a recognized name from curvePreferenceMap, e.g. 'CurveP256', 'CurveP384', 'CurveP521', 'X25519'
Inspect curvePreferenceMap in server/opts.go for the accepted set
Fix the config value spelling/casing

Example fix

// before
curve_preferences: ["secp256r1"]
// after
curve_preferences: ["CurveP256"]

Defensive patterns

Strategy: validation

Validate before calling

var validCurves = map[string]bool{"CurveP256": true, "CurveP384": true, "CurveP521": true, "X25519": true}
if !validCurves[curveName] { return fmt.Errorf("unknown curve %s", curveName) }

Try / catch

if err := validateCurves(cfg.CurvePreferences); err != nil { log.Fatalf("curve config invalid: %v", err) }

Prevention

Use Go TLS curve names, not SECG names
Check the server's curvePreferenceMap for accepted values
Lint config files against the server schema

When it happens

Trigger: Providing an unrecognized curve name in TLS curve preference options (e.g. 'curve_preferences: ["P256X"]' or calling parseCurvePreferences('secp256r1')).

Common situations: Using SECG/ECDSA names like 'secp256r1' instead of the expected Go-style names ('CurveP256', 'X25519'); typos in config.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/063d07b6e110750d. Report an issue: GitHub.