{"record":{"id":"056820b2006a0c36","repo":"slackhq/nebula","slug":"error-while-signing-w","errorCode":null,"errorMessage":"error while signing: %w","messagePattern":"error while signing: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":342,"sourceCode":"\n\t\tt := &cert.TBSCertificate{\n\t\t\tVersion:        cert.Version1,\n\t\t\tName:           *sf.name,\n\t\t\tNetworks:       []netip.Prefix{v4Networks[0]},\n\t\t\tGroups:         groups,\n\t\t\tUnsafeNetworks: v4UnsafeNetworks,\n\t\t\tNotBefore:      notBefore,\n\t\t\tNotAfter:       notAfter,\n\t\t\tPublicKey:      pub,\n\t\t\tIsCA:           false,\n\t\t\tCurve:          curve,\n\t\t}\n\n\t\tvar nc cert.Certificate\n\t\tif p11Client == nil {\n\t\t\tnc, err = t.Sign(caCert, curve, caKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing: %w\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tnc, err = t.SignWith(caCert, curve, p11Client.SignASN1)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tcrts = append(crts, nc)\n\n\tcase cert.Version2:\n\t\tt := &cert.TBSCertificate{\n\t\t\tVersion:        cert.Version2,\n\t\t\tName:           *sf.name,\n\t\t\tNetworks:       append(v4Networks, v6Networks...),\n\t\t\tGroups:         groups,\n\t\t\tUnsafeNetworks: append(v4UnsafeNetworks, v6UnsafeNetworks...),\n\t\t\tNotBefore:      notBefore,","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L324-L360","documentation":"For v1 certificates, TBSCertificate.Sign(caCert, curve, caKey) failed while producing the signed certificate with a software-held CA key. The underlying error (e.g. key/curve incompatibility, marshalling failure) is wrapped in this message. Signing could not complete, so no certificate is written.","triggerScenarios":"Running nebula-cert sign for a Version1 certificate when t.Sign fails — typically a CA key that does not match the declared curve, a corrupt/unsupported CA key, or an internal signing failure.","commonSituations":"CA key file rotated to a different curve than -curve argument; malformed ca.key PEM; using a CA cert whose key pair is inconsistent; go crypto signing returning an unsupported-key error.","solutions":["Confirm -curve matches the actual CA private key curve; regenerate or re-specify accordingly","Re-inspect the wrapped error for the root cause (key parsing vs signing) and fix the CA key file","Recreate the CA with `nebula-cert ca -curve ...` if the key/cert pair is corrupt or mismatched"],"exampleFix":"// before\nnebula-cert sign -ca ca.pem -key ca.key -curve CURVE25519 ...  # ca.key is actually P-256\n// after\nnebula-cert sign -ca ca.pem -key ca.key -curve P256 ...","handlingStrategy":"validation","validationCode":"# shell: confirm CA key curve matches the -curve flag before signing\nnebula-cert print -path ca.pem | grep -i curve\n# pass the same value to -curve (or omit and let it derive from CA)","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    if strings.Contains(err.Error(), \"error while signing:\") {\n        // log the wrapped cause; verify CA key parses with `nebula-cert print -path ca.key`\n    }\n    return err\n}","preventionTips":["Never edit or convert the CA key with external tools that may change its curve/encoding","Store CA cert+key as an atomic pair and verify with `nebula-cert print` after any rotation","Pin the -curve value in scripts to the value used at CA creation"],"tags":["pki","certificate-signing","signing-failure","nebula"],"backgroundTag":"certificate-signing-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}