{"record":{"id":"1d0344dbd8d53ed4","repo":"slackhq/nebula","slug":"no-networks-encoded-in-certificate","errorCode":null,"errorMessage":"no networks encoded in certificate","messagePattern":"no networks encoded in certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":530,"sourceCode":"\t\t\treturn nil, curve, false, fmt.Errorf(\"error while unmarshaling pki.key %s: %s\", privPathOrPEM, err)\n\t\t}\n\t}\n\n\treturn\n}\n\nfunc loadCertificate(b []byte) (cert.Certificate, []byte, error) {\n\tc, b, err := cert.UnmarshalCertificateFromPEM(b)\n\tif err != nil {\n\t\treturn nil, b, fmt.Errorf(\"error while unmarshaling pki.cert: %w\", err)\n\t}\n\n\tif c.Expired(time.Now()) {\n\t\treturn nil, b, fmt.Errorf(\"nebula certificate for this host is expired\")\n\t}\n\n\tif len(c.Networks()) == 0 {\n\t\treturn nil, b, fmt.Errorf(\"no networks encoded in certificate\")\n\t}\n\n\tif c.IsCA() {\n\t\treturn nil, b, fmt.Errorf(\"host certificate is a CA certificate\")\n\t}\n\n\treturn c, b, nil\n}\n\nfunc loadCAPoolFromConfig(l *slog.Logger, c *config.C) (*cert.CAPool, error) {\n\tcaPathOrPEM := c.GetString(\"pki.ca\", \"\")\n\tif caPathOrPEM == \"\" {\n\t\treturn nil, errors.New(\"no pki.ca path or PEM data provided\")\n\t}\n\n\tvar caReader io.ReadCloser\n\tvar err error\n","sourceCodeStart":512,"sourceCodeEnd":548,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L512-L548","documentation":"loadCertificate requires the host certificate to encode at least one network (VPN IP/CIDR). If c.Networks() is empty the certificate carries no address, which would leave the node without a tunnel IP, so startup fails with this error.","triggerScenarios":"newCertStateFromConfig parses a valid, unexpired certificate that simply has no networks encoded — typically a cert signed without an -ip/-cidr argument.","commonSituations":"Hand-edited or programmatically generated cert missing networks; signing with a tool/version that omits networks; using a CA or sub-package cert not intended as a host identity.","solutions":["Reissue the host cert including its VPN address, e.g. 'nebula-cert sign ... -ip 10.0.0.5/24'","Inspect the existing cert with 'nebula-cert print' to confirm networks are absent","Ensure config tun.dev/tunnel ranges match the network encoded in the new cert"],"exampleFix":"// before\nnebula-cert sign -ca-cpath ca.crt -ca-kpath ca.key -name host   # no -ip\n// after\nnebula-cert sign -ca-cpath ca.crt -ca-kpath ca.key -name host -ip 10.0.0.5/24","handlingStrategy":"validation","validationCode":"c, _, err := cert.UnmarshalCertificateFromPEM(certBytes)\nif err == nil && len(c.Networks()) == 0 {\n    return fmt.Errorf(\"cert has no networks; reissue with -ip\")\n}","typeGuard":"func certHasNetworks(c cert.Certificate) bool { return len(c.Networks()) > 0 }","tryCatchPattern":"if err := startNebula(); err != nil && strings.Contains(err.Error(), \"no networks encoded\") {\n    return fmt.Errorf(\"reissue host cert with an -ip argument: %w\", err)\n}","preventionTips":["Always pass -ip/-cidr when signing host certs","Inspect certs with 'nebula-cert print' in CI before rollout","Avoid hand-generated certificates; use nebula-cert workflows"],"tags":["pki","certificate","config"],"backgroundTag":"certificate-missing-networks","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}