slackhq/nebula · error

invalid curve: %s

Error message

invalid curve: %s

What it means

nebula-cert key generation rejected the -curve flag value: in non-PKCS#11 mode only 25519, X25519, Curve25519, CURVE25519 and P256 are accepted. Any other string returns this error before generating a keypair.

Source

Thrown at cmd/nebula-cert/keygen.go:75

		switch *cf.curve {
		case "P256":
			curve = cert.Curve_P256
		default:
			return fmt.Errorf("invalid curve for PKCS#11: %s", *cf.curve)
		}
	} else {
		switch *cf.curve {
		case "25519", "X25519", "Curve25519", "CURVE25519":
			if fips140.Enforced() {
				return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
			}
			pub, rawPriv = x25519Keypair()
			curve = cert.Curve_CURVE25519
		case "P256":
			pub, rawPriv = p256Keypair()
			curve = cert.Curve_P256
		default:
			return fmt.Errorf("invalid curve: %s", *cf.curve)
		}
	}

	var claims ioClaims
	if err := reserveOutputs(&claims,
		"out-key", *cf.outKeyPath,
		"out-pub", *cf.outPubPath,
	); err != nil {
		return err
	}

	if isP11 {
		p11Client, err := pkclient.FromUrl(*cf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()

View on GitHub (pinned to dd8f660c0a)

Solutions

  1. Use exactly "P256" or one of "25519", "X25519", "Curve25519", "CURVE25519".
  2. Remove the -curve flag entirely to use the default curve.
  3. Fix case sensitivity — "p256" lowercase is not accepted.
  4. Check the script/config for copied OpenSSL-style curve names and translate them.

Example fix

// before
nebula-cert keygen -curve p256 -out-key host.key -out-pub host.pub
// after
nebula-cert keygen -curve P256 -out-key host.key -out-pub host.pub
Defensive patterns

Strategy: validation

Validate before calling

#!/bin/sh
case "$CURVE" in
  25519|X25519|Curve25519|CURVE25519|P256) ;;
  *) echo "invalid -curve '$CURVE': use 25519 or P256" >&2; exit 1 ;;
esac

Type guard

var validCurves = map[string]bool{
    "25519": true, "X25519": true, "Curve25519": true, "CURVE25519": true, "P256": true,
}

func validCurve(curve string) bool { return validCurves[curve] }

Prevention

When it happens

Trigger: Running `nebula-cert keygen` (or `ca`-adjacent keygen flow) with -curve set to an unrecognized string such as "p-256" (lowercase), "ed25519", "RSA", or a typo like "Curve2559".

Common situations: Case/normalization mistakes ("p256" vs "P256"); copying curve names from other tools (openssl "prime256v1"); typos in automation scripts.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/d44a52c0e514507f. Report an issue: GitHub.