{"record":{"id":"14845f480a7462be","repo":"slackhq/nebula","slug":"error-while-getting-public-key-with-pkcs-11-w-14845f","errorCode":null,"errorMessage":"error while getting public key with PKCS#11: %w","messagePattern":"error while getting public key with PKCS#11: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":293,"sourceCode":"\n\tif *sf.inPubPath != \"\" {\n\t\tvar pubCurve cert.Curve\n\t\trawPub, err := readInput(\"in-pub\", *sf.inPubPath, &claims)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while reading in-pub: %s\", err)\n\t\t}\n\n\t\tpub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing in-pub: %s\", err)\n\t\t}\n\t\tif pubCurve != curve {\n\t\t\treturn fmt.Errorf(\"curve of in-pub does not match ca\")\n\t\t}\n\t} else if isP11 {\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tpub, rawPriv = newKeypair(curve)\n\t}\n\n\tif !isStdio(*sf.outCertPath) {\n\t\tif _, err := os.Stat(*sf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing cert: %s\", *sf.outCertPath)\n\t\t}\n\t}\n\n\tvar crts []cert.Certificate\n\n\tnotBefore := time.Now()\n\tnotAfter := notBefore.Add(*sf.duration)\n\n\tswitch version {\n\tcase cert.Version1:","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L275-L311","documentation":"When -pkcs11 is used, the public key is not read from a file but fetched from the HSM/token via p11Client.GetPubKey() (cmd/nebula-cert/sign.go:291). If the token operation fails (slot/login/URL problems or key not found), the underlying error is wrapped and returned. The command cannot proceed because it needs the token-held public key to embed in the new certificate.","triggerScenarios":"Running `nebula-cert sign -pkcs11 ...` when the PKCS#11 URI is wrong, the token is not logged in, the private key object cannot be located, or the HSM library fails during GetPubKey.","commonSituations":"Wrong -p11-url / missing module path; token not plugged in or locked; user not logged into the slot; key object absent from the token; FIPS/ACL policies denying public-key export or derivation.","solutions":["Verify the PKCS#11 URI and module library path; test with pkcs11-tool --list-objects to confirm the key exists","Ensure the token is present and logged in (correct PIN/session) before running the command","Check that the referenced key object id/label matches the URI; regenerate or re-import the key if missing"],"exampleFix":"// before\nnebula-cert sign -pkcs11 -p11-url 'pkcs11:token=WRONGTOKEN;object=nebula' ...\n// after\nnebula-cert sign -pkcs11 -p11-url 'pkcs11:token=nebula-hsm;object=nebula;pin-source=/etc/nebula/pin' ...","handlingStrategy":"validation","validationCode":"# shell: check token and key exist before signing\npkcs11-tool --module /usr/lib/softhsm.so --list-objects --token-label nebula\n# confirm the URI in -p11-url matches token/label/id above","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    var p11Err *pkclient.Error\n    if errors.As(err, &p11Err) {\n        // inspect CKR code, re-login or re-open session, then retry once\n    }\n    return err\n}","preventionTips":["Validate the PKCS#11 URI with pkcs11-tool before running nebula-cert sign","Use pin-source/pin-value in the URI to guarantee login","Keep the HSM module path configured and test connectivity after token changes"],"tags":["pkcs11","hsm","pki","nebula"],"backgroundTag":"pkcs11-key-access-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}