slackhq/nebula · error

invalid curve: %s

Error message

invalid curve: %s

What it means

Returned when -curve given to `nebula-cert ca` is not one of the recognized values (25519/X25519/Curve25519/CURVE25519 or P256) in non-PKCS#11 mode. It is a pure input-validation error listing no valid alternatives, so the message echoes the supplied curve string.

Source

Thrown at cmd/nebula-cert/ca.go:296

			}
		case "P256":
			var key *ecdsa.PrivateKey
			curve = cert.Curve_P256
			key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
			if err != nil {
				return fmt.Errorf("error while generating ecdsa keys: %s", err)
			}

			// ecdh.PrivateKey lets us get at the encoded bytes, even though
			// we aren't using ECDH here.
			eKey, err := key.ECDH()
			if err != nil {
				return fmt.Errorf("error while converting ecdsa key: %s", err)
			}
			rawPriv = eKey.Bytes()
			pub = eKey.PublicKey().Bytes()
		default:
			return fmt.Errorf("invalid curve: %s", *cf.curve)
		}
	}

	t := &cert.TBSCertificate{
		Version:        version,
		Name:           *cf.name,
		Groups:         groups,
		Networks:       networks,
		UnsafeNetworks: unsafeNetworks,
		NotBefore:      time.Now(),
		NotAfter:       time.Now().Add(*cf.duration),
		PublicKey:      pub,
		IsCA:           true,
		Curve:          curve,
	}

	if !isP11 && !isStdio(*cf.outKeyPath) {
		if _, err := os.Stat(*cf.outKeyPath); err == nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Use -curve 25519 or -curve P256 (names are case-sensitive)
2. Pick P256 if operating under FIPS 140-only mode, since 25519 is rejected there
3. If PKCS#11 mode is intended, note only -curve P256 is valid there
4. Check the script/env supplying the curve value for typos or emptiness

Example fix

// before
nebula-cert ca -curve p256 -name "my ca"
// after
nebula-cert ca -curve P256 -name "my ca"

validCurves := map[string]bool{"25519": true, "X25519": true, "Curve25519": true, "CURVE25519": true, "P256": true}
if !validCurves[curve] {
	return fmt.Errorf("unsupported curve %q; use 25519 or P256", curve)
}

func isValidCurve(c string) bool {
	switch c {
	case "25519", "X25519", "Curve25519", "CURVE25519", "P256":
		return true
	}
	return false
}

When it happens

Trigger: nebula-cert ca -curve <value> where <value> is any string other than 25519, X25519, Curve25519, CURVE25519, or P256 — e.g. 'ed25519', 'secp256r1', 'P-256', 'p256' (case-sensitive), or an empty string.

Common situations: Typo or wrong casing ('p256' vs 'P256'); using ECDSA-style names ('secp256k1', 'P-384') unsupported by nebula; scripts passing a curve variable that is unset/empty; confusing this path with PKCS#11 mode where only P256 is allowed.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• invalid curve for PKCS#11: %s
• invalid curve: %s
• invalid curve: %s
• salt must be at least 128 bits
• invalid curve: %v

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/7e7ccdfd6fd2981e. Report an issue: GitHub.