{"record":{"id":"0bc7dd6e50d6a049","repo":"slackhq/nebula","slug":"error-while-writing-out-key-s-0bc7dd","errorCode":null,"errorMessage":"error while writing out-key: %s","messagePattern":"error while writing out-key: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/keygen.go","lineNumber":102,"sourceCode":"\t\treturn err\n\t}\n\n\tif isP11 {\n\t\tp11Client, err := pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key: %w\", err)\n\t\t}\n\t} else {\n\t\terr = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\terr = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-pub: %s\", err)\n\t}\n\n\treturn nil\n}\n\nfunc keygenSummary() string {\n\treturn \"keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`\"\n}\n\nfunc keygenHelp(out io.Writer) {\n\tcf := newKeygenFlags()\n\t_, _ = out.Write([]byte(\"Usage of \" + os.Args[0] + \" \" + keygenSummary() + \"\\n\"))\n\t_, _ = out.Write([]byte(stdioHelpText))","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/keygen.go#L84-L120","documentation":"nebula-cert's key generation failed while writing the generated private key PEM to the path given via -out-key. The keypair (software mode) was created, but writeOutput failed; the underlying OS error is embedded in the message.","triggerScenarios":"Running `nebula-cert keygen -out-key <path>` where writeOutput(*cf.outKeyPath, b, 0600, out) fails: missing parent directory, permission denied, path is a directory, or disk full.","commonSituations":"Typo in -out-key path; read-only container filesystem or CI workspace; non-root user lacking write permission to /etc/nebula; the -out-key path colliding with an existing directory.","solutions":["Ensure the -out-key parent directory exists and is writable (mkdir -p, chown/chmod).","Provide an absolute writable path or run from a writable directory.","Verify the target is a file path, not a directory.","Check disk space if the filesystem is full."],"exampleFix":"// before\nnebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/host.pub\n// after\nmkdir -p /etc/nebula && nebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/host.pub","handlingStrategy":"try-catch","validationCode":"#!/bin/sh\nKEY_DIR=$(dirname \"$OUT_KEY_PATH\")\n[ -d \"$KEY_DIR\" ] || mkdir -p \"$KEY_DIR\"\n[ -w \"$KEY_DIR\" ] || { echo \"cannot write $KEY_DIR\" >&2; exit 1; }\n[ ! -d \"$OUT_KEY_PATH\" ] || { echo \"$OUT_KEY_PATH is a directory\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\nif err != nil {\n    return fmt.Errorf(\"error while writing out-key: %s\", err)\n}","preventionTips":["Pre-create the output directory with correct ownership.","Run keygen as a user permitted to write the key location.","Use absolute paths in scripts/CI.","Verify the -out-key target is not a directory."],"tags":["filesystem","cli","keygen"],"backgroundTag":"file-write-permission-denied","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}