{"record":{"id":"15d1d702f2f131e5","repo":"slackhq/nebula","slug":"unable-to-read-pki-key-file-s-s","errorCode":null,"errorMessage":"unable to read pki.key file %s: %s","messagePattern":"unable to read pki\\.key file (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":508,"sourceCode":"\treturn &cs, nil\n}\n\nfunc loadPrivateKey(privPathOrPEM string) (rawKey []byte, curve cert.Curve, isPkcs11 bool, err error) {\n\tvar pemPrivateKey []byte\n\tif strings.Contains(privPathOrPEM, \"-----BEGIN\") {\n\t\tpemPrivateKey = []byte(privPathOrPEM)\n\t\tprivPathOrPEM = \"<inline>\"\n\t\trawKey, _, curve, err = cert.UnmarshalPrivateKeyFromPEM(pemPrivateKey)\n\t\tif err != nil {\n\t\t\treturn nil, curve, false, fmt.Errorf(\"error while unmarshaling pki.key %s: %s\", privPathOrPEM, err)\n\t\t}\n\t} else if strings.HasPrefix(privPathOrPEM, \"pkcs11:\") {\n\t\trawKey = []byte(privPathOrPEM)\n\t\treturn rawKey, cert.Curve_P256, true, nil\n\t} else {\n\t\tpemPrivateKey, err = os.ReadFile(privPathOrPEM)\n\t\tif err != nil {\n\t\t\treturn nil, curve, false, fmt.Errorf(\"unable to read pki.key file %s: %s\", privPathOrPEM, err)\n\t\t}\n\t\trawKey, _, curve, err = cert.UnmarshalPrivateKeyFromPEM(pemPrivateKey)\n\t\tif err != nil {\n\t\t\treturn nil, curve, false, fmt.Errorf(\"error while unmarshaling pki.key %s: %s\", privPathOrPEM, err)\n\t\t}\n\t}\n\n\treturn\n}\n\nfunc loadCertificate(b []byte) (cert.Certificate, []byte, error) {\n\tc, b, err := cert.UnmarshalCertificateFromPEM(b)\n\tif err != nil {\n\t\treturn nil, b, fmt.Errorf(\"error while unmarshaling pki.cert: %w\", err)\n\t}\n\n\tif c.Expired(time.Now()) {\n\t\treturn nil, b, fmt.Errorf(\"nebula certificate for this host is expired\")","sourceCodeStart":490,"sourceCodeEnd":526,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L490-L526","documentation":"Wrapping error in loadPrivateKey: the inline PEM supplied via pki.key (a literal PEM string containing -----BEGIN rather than a path) failed to unmarshal as a private key. The offending value is reported as \"<inline>\" with the underlying error appended via %s.","triggerScenarios":"Thrown at pki.go:508 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the inline PEM to be a valid Nebula private key (correct banner, untruncated base64)","Point pki.key at the key file path instead of pasting the PEM","If the key is encrypted, provide it in a form/config the loader supports"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// stat the key file and check readability before starting\nfunc keyFileReadable(path string) error {\n    fi, err := os.Stat(path)\n    if err != nil { return err }\n    if fi.IsDir() { return fmt.Errorf(\"%s is a directory\", path) }\n    f, err := os.Open(path); if err != nil { return err }\n    return f.Close()\n}","typeGuard":null,"tryCatchPattern":"if err := loadPrivateKey(keyPath); err != nil {\n    var pathErr *os.PathError\n    if errors.As(err, errors.Unwrap(err), &pathErr) || strings.Contains(err.Error(), \"unable to read pki.key\") {\n        log.Fatalf(\"cannot read pki.key at %s; check path, mount and permissions: %v\", keyPath, err)\n    }\n    return err\n}","preventionTips":["Mount/copy the key file before the nebula unit starts (systemd After=/Requires=)","Set owner to the nebula service user and mode 600","Use absolute paths and verify them in deployment manifests"],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}