{"record":{"id":"024b854b023f9410","repo":"slackhq/nebula","slug":"errinvalidpemed25519publickeybanner","errorCode":"ErrInvalidPEMEd25519PublicKeyBanner","errorMessage":"bytes did not contain a proper Ed25519 public key banner","messagePattern":"bytes did not contain a proper Ed25519 public key banner","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":31,"sourceCode":"\tErrNotSelfSigned              = errors.New(\"certificate is not self-signed\")\n\tErrBlockListed                = errors.New(\"certificate is in the block list\")\n\tErrFingerprintMismatch        = errors.New(\"certificate fingerprint did not match\")\n\tErrSignatureMismatch          = errors.New(\"certificate signature did not match\")\n\tErrInvalidPublicKey           = errors.New(\"invalid public key\")\n\tErrInvalidPrivateKey          = errors.New(\"invalid private key\")\n\tErrPublicPrivateCurveMismatch = errors.New(\"public key does not match private key curve\")\n\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")\n\tErrInvalidPEMCertificateBanner       = errors.New(\"bytes did not contain a proper certificate banner\")\n\tErrInvalidPEMX25519PublicKeyBanner   = errors.New(\"bytes did not contain a proper X25519 public key banner\")\n\tErrInvalidPEMX25519PrivateKeyBanner  = errors.New(\"bytes did not contain a proper X25519 private key banner\")\n\tErrInvalidPEMEd25519PublicKeyBanner  = errors.New(\"bytes did not contain a proper Ed25519 public key banner\")\n\tErrInvalidPEMEd25519PrivateKeyBanner = errors.New(\"bytes did not contain a proper Ed25519 private key banner\")\n\n\tErrNoPeerStaticKey = errors.New(\"no peer static key was present\")\n\tErrNoPayload       = errors.New(\"provided payload was empty\")\n\n\tErrMissingDetails  = errors.New(\"certificate did not contain details\")\n\tErrEmptySignature  = errors.New(\"empty signature\")\n\tErrEmptyRawDetails = errors.New(\"empty rawDetails not allowed\")\n)\n\ntype ErrInvalidCertificateProperties struct {\n\tstr string\n}\n\nfunc NewErrInvalidCertificateProperties(format string, a ...any) error {\n\treturn &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}\n}\n","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L13-L49","documentation":"ErrInvalidPEMEd25519PublicKeyBanner is thrown when PEM bytes expected to contain an Ed25519 public key do not carry the proper Ed25519 PUBLIC KEY banner. The parser matches the PEM block type against the expected key kind and rejects any other banner (certificate, private key, X25519 key).","triggerScenarios":"Feeding an Ed25519 public key decoder bytes whose PEM block type is not the expected Ed25519 public key banner — e.g. a private key, an X25519 public key, or a certificate.","commonSituations":"Swapped public/private key files in config; publishing a peer's static key where a certificate was intended; keys rotated to a different curve; copy-paste truncating the PEM header.","solutions":["Confirm the PEM file's BEGIN line declares an Ed25519 public key","Point the config at the peer's Ed25519 public key file rather than the private key or certificate","Re-export or regenerate the peer public key for the Ed25519 curve if the wrong key type was distributed"],"exampleFix":"// before\npub, _ := os.ReadFile(\"ca.crt\") // certificate, not a key\n// after\npub, _ := os.ReadFile(\"peer_ed25519.pub\") // proper Ed25519 PUBLIC KEY banner","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(pubBytes)\nif block == nil || !strings.Contains(block.Type, \"ED25519 PUBLIC KEY\") {\n    return fmt.Errorf(\"not an Ed25519 public key PEM\")\n}","typeGuard":"func isEd25519PublicKeyPEM(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    return blk != nil && strings.Contains(blk.Type, \"ED25519 PUBLIC KEY\")\n}","tryCatchPattern":"pub, err := loadEd25519PubKey(pubBytes)\nif errors.Is(err, cert.ErrInvalidPEMEd25519PublicKeyBanner) {\n    // wrong banner: check file paths and key type\n}","preventionTips":["Distribute peer public keys with a .pub extension and the correct banner","Sanity-check banner type when receiving peer keys over the wire","Avoid copy-paste of PEM blocks; load from files to prevent truncation"],"tags":["pem","ed25519","key-parsing","config"],"backgroundTag":"invalid-pem-banner","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}