nats-io/nats-server · error

unsupported ECC curve name

Error message

unsupported ECC curve name

What it means

ErrBadECCCurveName is returned when the library maps a Windows cryptographic algorithm/curve identifier to a Go elliptic curve and the name is not one it supports. The library only translates a fixed set of known ECC curve names; anything else is rejected.

Source

Thrown at server/certstore/errors.go:45

	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

	// ErrBadCertStoreField represents malformed cert_store option
	ErrBadCertStoreField = errors.New("expected 'cert_store' to be a valid non-empty string")

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Use a certificate with a widely supported curve (P-256, P-384, P-521) issued or re-issued accordingly.
  2. Check the cert's signature/public-key algorithm (certutil -v) to confirm which curve is in use.
  3. If a non-standard curve is required, use file-based TLS config (cert_file/key_file parsed by Go's stdlib) instead of the Windows store path.
  4. Update to a newer library version that may support additional curves.

Example fix

// before: cert on unsupported curve secp256k1
// reissue:
// after:
// openssl ecparam -name prime256v1 -genkey -noout -out key.pem
// openssl req -new -x509 -key key.pem -out cert.pem
Defensive patterns

Strategy: validation

Validate before calling

// Check the cert's public key curve before configuring store-based TLS
der, _ := exportCertFromStore(...)
cert, err := x509.ParseCertificate(der)
if err == nil {
    if pk, ok := cert.PublicKey.(*ecdsa.PublicKey); ok {
        switch pk.Curve.Params().Name {
        case "P-256", "P-384", "P-521":
        default:
            log.Fatalf("unsupported curve %s", pk.Curve.Params().Name)
        }
    }
}

Type guard

func isBadCurveErr(err error) bool { return errors.Is(err, certstore.ErrBadECCCurveName) }

Try / catch

if errors.Is(err, certstore.ErrBadECCCurveName) {
    // reissue cert with P-256/P-384/P-521 or fall back to cert_file TLS
}

Prevention

When it happens

Trigger: On Windows, certKey/extractPublicKey resolves the key's algorithm via CryptoAPI; at certstore_windows.go:898 the curve name lookup in the curve map fails (ok == false) and this error is returned instead of a crypto elliptic.Curve.

Common situations: Certificates signed with uncommon curves (e.g. secp256k1, GOST, or newer curve OIDs not in the library's mapping table) used for TLS in the Windows cert store.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/379d3a67f2c269d8. Report an issue: GitHub.