{"record":{"id":"09c8084e695f0af7","repo":"slackhq/nebula","slug":"error-while-signing-s","errorCode":null,"errorMessage":"error while signing: %s","messagePattern":"error while signing: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":336,"sourceCode":"\n\tif !isStdio(*cf.outCertPath) {\n\t\tif _, err := os.Stat(*cf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA cert: %s\", *cf.outCertPath)\n\t\t}\n\t}\n\n\tvar c cert.Certificate\n\tvar b []byte\n\n\tif isP11 {\n\t\tc, err = t.SignWith(nil, curve, p11Client.SignASN1)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tc, err = t.Sign(nil, curve, rawPriv)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing: %s\", err)\n\t\t}\n\n\t\tif *cf.encryption {\n\t\t\tb, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while encrypting out-key: %s\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tb = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)\n\t\t}\n\n\t\terr = writeOutput(*cf.outKeyPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tb, err = c.MarshalPEM()","sourceCodeStart":318,"sourceCodeEnd":354,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L318-L354","documentation":"Wraps a failure from t.Sign(nil, curve, rawPriv) when signing the CA certificate locally with the freshly generated raw private key in `nebula-cert ca`. Signing is done in-process over the TBSCertificate, so failure indicates the crypto/sign operation itself rejected the key/curve combination rather than any I/O problem.","triggerScenarios":"nebula-cert ca (non-PKCS#11) where t.Sign fails — practically limited to an unusable/zero rawPriv (e.g. a Curve25519 key generated in a broken environment) or a crypto library rejecting the signature input.","commonSituations":"Broken key generation upstream (empty rawPriv due to earlier environment failure); patched or custom crypto builds; inconsistent key/curve pairing in modified code.","solutions":["Fix any upstream key-generation failure first (this error usually follows one)","Rerun the command; local signing of a fresh key is deterministic and should succeed","Verify unmodified Go crypto packages (no vendored overrides)","If reproducible with stock builds, report to nebula maintainers with the wrapped error"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", ...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error while signing\") && !strings.Contains(string(out), \"PKCS#11\") {\n\tlog.Printf(\"local signing failed: %s\", out)\n\treturn fmt.Errorf(\"cert signing failed: %s\", out)\n}","preventionTips":["Resolve any upstream key-generation errors first — this failure usually follows one","Keep Go crypto packages unmodified (no vendor patches)","If persistent on stock builds, capture the wrapped error and report upstream"],"tags":["signing","crypto","cli"],"backgroundTag":"certificate-signing-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}