{"record":{"id":"1797b415419219e0","repo":"slackhq/nebula","slug":"error-marshalling-v2-certificate-for-handshake-w","errorCode":null,"errorMessage":"error marshalling v2 certificate for handshake: %w","messagePattern":"error marshalling v2 certificate for handshake: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":454,"sourceCode":"\t\tcs.v1Credential = handshake.NewCredential(v1, v1hs, privateKey, ncs)\n\n\t\tif cs.initiatingVersion == 0 {\n\t\t\tcs.initiatingVersion = cert.Version1\n\t\t}\n\t}\n\n\tif v2 != nil {\n\t\tif pkcs11backed {\n\t\t\t//NOTE: We do not currently have a method to verify a public private key pair when the private key is in an hsm\n\t\t} else {\n\t\t\tif err := v2.VerifyPrivateKey(privateKeyCurve, privateKey); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"private key is not a pair with public key in nebula cert: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tv2hs, err := v2.MarshalForHandshakes()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error marshalling v2 certificate for handshake: %w\", err)\n\t\t}\n\t\tncs, err := newCipherSuite(v2.Curve(), pkcs11backed, cipher, fips140.Enforced())\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tcs.v2Cert = v2\n\t\tcs.v2Credential = handshake.NewCredential(v2, v2hs, privateKey, ncs)\n\n\t\tif cs.initiatingVersion == 0 {\n\t\t\tcs.initiatingVersion = cert.Version2\n\t\t}\n\t}\n\n\tvar crt cert.Certificate\n\tcrt = cs.getCertificate(cert.Version2)\n\tif crt == nil {\n\t\t// v2 certificates are a superset, only look at v1 if its all we have\n\t\tcrt = cs.getCertificate(cert.Version1)","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L436-L472","documentation":"Wrapping error in newCertState: v2.MarshalForHandshakes failed while preparing the cached wire form of the v2 certificate for handshakes. The v2 cert parsed and its key pair verified, but producing the handshake bytes failed; cause preserved with %w.","triggerScenarios":"newCertState: a v2 certificate passed private-key verification but v2.MarshalForHandshakes() returned an error — structurally invalid v2 certificate in pki.cert.","commonSituations":"Corrupted or truncated v2 certificate; certificate emitted by incompatible/buggy tooling; manual edits to the PEM bundle.","solutions":["Re-generate the v2 certificate with nebula-cert sign and replace pki.cert","Inspect with nebula-cert print -path pki.cert to see the parse failure","Restore pki.cert from a known-good backup"],"exampleFix":"// before: corrupted v2 cert in pki.cert\n// after\nnebula-cert sign -ca-crt ca.crt -ca-key ca.key -name host1 -ip 10.0.0.1/24 -out-crt pki.cert","handlingStrategy":"validation","validationCode":"// pre-parse the v2 cert to catch marshal problems early\nfunc validateV2Cert(certPEM []byte) error {\n    crt, _, err := cert.UnmarshalCertificateFromPEM(certPEM)\n    if err != nil { return err }\n    if crt.Version() == cert.Version2 {\n        if _, err := crt.MarshalForHandshakes(); err != nil { return err }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := reloadCerts(); err != nil {\n    if strings.Contains(err.Error(), \"marshalling v2 certificate\") {\n        log.Fatalf(\"v2 certificate in pki.cert is corrupt; re-issue it: %v\", err)\n    }\n    return err\n}","preventionTips":["Issue v2 certificates only with up-to-date nebula-cert tooling","Transfer certificates with checksum verification (scp/checksum in CI)","Restore from backup rather than editing a corrupt PEM"],"tags":["pki","certificate","serialization"],"backgroundTag":"certificate-marshal-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}