{"record":{"id":"16e3685584e9d508","repo":"slackhq/nebula","slug":"no-pki-cert-path-or-pem-data-provided","errorCode":null,"errorMessage":"no pki.cert path or PEM data provided","messagePattern":"no pki\\.cert path or PEM data provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pki.go","lineNumber":318,"sourceCode":"\nfunc newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) {\n\tvar err error\n\n\tprivPathOrPEM := c.GetString(\"pki.key\", \"\")\n\tif privPathOrPEM == \"\" {\n\t\treturn nil, errors.New(\"no pki.key path or PEM data provided\")\n\t}\n\n\trawKey, curve, isPkcs11, err := loadPrivateKey(privPathOrPEM)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar rawCert []byte\n\n\tpubPathOrPEM := c.GetString(\"pki.cert\", \"\")\n\tif pubPathOrPEM == \"\" {\n\t\treturn nil, errors.New(\"no pki.cert path or PEM data provided\")\n\t}\n\n\tif strings.Contains(pubPathOrPEM, \"-----BEGIN\") {\n\t\trawCert = []byte(pubPathOrPEM)\n\t\tpubPathOrPEM = \"<inline>\"\n\n\t} else {\n\t\trawCert, err = os.ReadFile(pubPathOrPEM)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to read pki.cert file %s: %s\", pubPathOrPEM, err)\n\t\t}\n\t}\n\n\tvar crt, v1, v2 cert.Certificate\n\tfor {\n\t\t// Load the certificate\n\t\tcrt, rawCert, err = loadCertificate(rawCert)\n\t\tif err != nil {","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L300-L336","documentation":"After loading the private key, newCertStateFromConfig reads 'pki.cert'. If that string is empty the node has no public certificate to present, so it returns this error. pki.cert must be either a file path or inline PEM containing the certificate.","triggerScenarios":"reloadCerts → newCertStateFromConfig with config where c.GetString(\"pki.cert\", \"\") is \"\" — pki.cert absent or empty in the config.","commonSituations":"Config template only defines pki.key; cert file path renamed/moved without updating config; provisioning system failed to copy the certificate; typo like pki.certificate instead of pki.cert.","solutions":["Set pki.cert in the config to the certificate path or inline PEM ('-----BEGIN CERTIFICATE-----').","Confirm the cert file exists at the configured path and is readable (path errors here come later, so an empty string usually means the setting itself is missing).","Ensure the value is non-empty even when using inline PEM — an empty env-expanded variable (e.g. $NEBULA_CERT unset) yields this error."],"exampleFix":"// before\npki:\n  key: /etc/nebula/host.key\n// after\npki:\n  key: /etc/nebula/host.key\n  cert: /etc/nebula/host.crt","handlingStrategy":"validation","validationCode":"if c.GetString(\"pki.cert\", \"\") == \"\" {\n    return errors.New(\"config is missing pki.cert: set a cert file path or inline PEM\")\n}","typeGuard":null,"tryCatchPattern":"if err := reloadCerts(); err != nil {\n    if strings.Contains(err.Error(), \"no pki.cert\") {\n        log.Fatal(\"nebula config has no pki.cert set\")\n    }\n}","preventionTips":["Ship configs with all three pki entries (cert, key, ca) and diff against a reference schema","Check file provisioning completed before starting nebula","Expand env vars in CI and assert none expand to empty for pki settings"],"tags":["pki","config","nebula","missing-cert"],"backgroundTag":"missing-pki-cert","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}