{"record":{"id":"0e68efb7b2c530fa","repo":"slackhq/nebula","slug":"cannot-open-encrypted-ca-key-without-passphrase","errorCode":null,"errorMessage":"cannot open encrypted ca-key without passphrase","messagePattern":"cannot open encrypted ca-key without passphrase","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":164,"sourceCode":"\t\t\tpassphrase = []byte(os.Getenv(\"NEBULA_CA_PASSPHRASE\"))\n\t\t\tif len(passphrase) == 0 {\n\t\t\t\t// ask for a passphrase until we get one\n\t\t\t\tfor i := 0; i < 5; i++ {\n\t\t\t\t\terrOut.Write([]byte(\"Enter passphrase: \"))\n\t\t\t\t\tpassphrase, err = pr.ReadPassword()\n\n\t\t\t\t\tif errors.Is(err, ErrNoTerminal) {\n\t\t\t\t\t\treturn fmt.Errorf(\"ca-key is encrypted and must be decrypted interactively\")\n\t\t\t\t\t} else if err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"error reading password: %s\", err)\n\t\t\t\t\t}\n\n\t\t\t\t\tif len(passphrase) > 0 {\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif len(passphrase) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cannot open encrypted ca-key without passphrase\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tcurve, caKey, _, err = cert.DecryptAndUnmarshalSigningPrivateKey(passphrase, rawCAKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while parsing encrypted ca-key: %s\", err)\n\t\t\t}\n\t\t} else if err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing ca-key: %s\", err)\n\t\t}\n\t}\n\n\trawCACert, err := readInput(\"ca-crt\", *sf.caCertPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while reading ca-crt: %s\", err)\n\t}\n\n\tcaCert, _, err := cert.UnmarshalCertificateFromPEM(rawCACert)\n\tif err != nil {","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L146-L182","documentation":"Terminal-state error in signCert: the CA key PEM is encrypted, no NEBULA_CA_PASSPHRASE env var was set, and five interactive passphrase prompts yielded nothing (or input is not a TTY loop ended). The encrypted key cannot be opened, so signing aborts.","triggerScenarios":"Thrown at cmd/nebula-cert/sign.go:164 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set NEBULA_CA_PASSPHRASE to the correct passphrase","Run in a terminal and enter the passphrase when prompted","Re-generate an unencrypted CA key if encryption is not required"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}