{"record":{"id":"13fff599874c6bce","repo":"slackhq/nebula","slug":"error-while-encrypting-out-key-s","errorCode":null,"errorMessage":"error while encrypting out-key: %s","messagePattern":"error while encrypting out-key: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":342,"sourceCode":"\n\tvar c cert.Certificate\n\tvar b []byte\n\n\tif isP11 {\n\t\tc, err = t.SignWith(nil, curve, p11Client.SignASN1)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tc, err = t.Sign(nil, curve, rawPriv)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing: %s\", err)\n\t\t}\n\n\t\tif *cf.encryption {\n\t\t\tb, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while encrypting out-key: %s\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tb = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)\n\t\t}\n\n\t\terr = writeOutput(*cf.outKeyPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tb, err = c.MarshalPEM()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t}\n\n\terr = writeOutput(*cf.outCertPath, b, 0600, out)\n\tif err != nil {","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L324-L360","documentation":"Wraps a failure from cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams) when -encrypt is set in `nebula-cert ca`. The private key could not be encrypted and marshaled (e.g. KDF derivation or AEAD sealing failed), so the command aborts before writing the key file.","triggerScenarios":"nebula-cert ca -encrypt ... where EncryptAndMarshalSigningPrivateKey fails: passphrase rejected by the crypto layer, unsupported curve for encryption, or internal KDF/AEAD failure (rare; usually indicates invalid inputs like an empty passphrase slipped past earlier checks).","commonSituations":"Scripting passes an empty or malformed passphrase via -nonce/-passphrase handling; FIPS-mode crypto rejecting the configured KDF parameters; inconsistent flag combinations (encryption enabled with stdio without passphrase).","solutions":["Ensure a valid non-empty passphrase is provided when -encrypt is set","Check the wrapped error for KDF/AEAD specifics and adjust crypto settings (FIPS mode, kdf params)","Drop -encrypt to write the key in plaintext PEM if protection is handled elsewhere","Upgrade nebula if the wrapped error points to a known crypto-library incompatibility"],"exampleFix":"// before\nnebula-cert ca -encrypt -name \"my ca\"           # empty passphrase reaches encryption\n// after\nnebula-cert ca -encrypt -name \"my ca\"           # ensure -passphrase/-nonce supplied\n# or drop encryption:\nnebula-cert ca -name \"my ca\"","handlingStrategy":"validation","validationCode":"if encrypt && (passphrase == \"\") {\n\treturn fmt.Errorf(\"-encrypt requires a non-empty passphrase\")\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", \"-encrypt\", ...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error while encrypting out-key\") {\n\tlog.Printf(\"key encryption failed: %s\", out)\n\treturn fmt.Errorf(\"could not encrypt key: %s\", out)\n}","preventionTips":["Always supply a non-empty passphrase when using -encrypt","Keep flag combinations consistent (encrypt implies a passphrase source)","Check FIPS/KDF compatibility if using restricted crypto modes","Store passphrases in a secret manager, not inline in scripts"],"tags":["encryption","crypto","passphrase","cli"],"backgroundTag":"key-encryption-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}