{"record":{"id":"1d5628736d62b5b1","repo":"slackhq/nebula","slug":"could-not-calculate-fingerprint-for-provided-ca-e","errorCode":null,"errorMessage":"could not calculate fingerprint for provided CA; error: %w; %s","messagePattern":"could not calculate fingerprint for provided CA; error: %w; (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/ca_pool.go","lineNumber":112,"sourceCode":"\t\treturn pemBytes, err\n\t}\n\n\treturn pemBytes, nil\n}\n\n// AddCA verifies a Nebula CA certificate and adds it to the pool.\nfunc (ncp *CAPool) AddCA(c Certificate) error {\n\tif !c.IsCA() {\n\t\treturn fmt.Errorf(\"%s: %w\", c.Name(), ErrNotCA)\n\t}\n\n\tif !c.CheckSignature(c.PublicKey()) {\n\t\treturn fmt.Errorf(\"%s: %w\", c.Name(), ErrNotSelfSigned)\n\t}\n\n\tsum, err := c.Fingerprint()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not calculate fingerprint for provided CA; error: %w; %s\", err, c.Name())\n\t}\n\n\tcc := &CachedCertificate{\n\t\tCertificate:    c,\n\t\tFingerprint:    sum,\n\t\tInvertedGroups: make(map[string]struct{}),\n\t}\n\n\tfor _, g := range c.Groups() {\n\t\tcc.InvertedGroups[g] = struct{}{}\n\t}\n\n\tncp.CAs[sum] = cc\n\n\tif c.Expired(time.Now()) {\n\t\treturn fmt.Errorf(\"%s: %w\", c.Name(), ErrExpired)\n\t}\n","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/ca_pool.go#L94-L130","documentation":"CAPool.AddCA calls c.Fingerprint() to compute the SHA-256 fingerprint used as the pool key for the CA; if that computation returns an error, this message wraps the underlying error along with the certificate name. Fingerprinting should only fail if the certificate's raw data is unavailable or malformed.","triggerScenarios":"Calling AddCA with a Certificate implementation whose Fingerprint() fails (e.g. corrupted internal state or unreadable raw bytes), propagating the wrapped hash error.","commonSituations":"Programmatically constructed or deserialized certificates with missing raw bytes, custom Certificate implementations with broken Fingerprint methods, or certs decoded from damaged data.","solutions":["Re-decode the certificate from a known-good PEM source and retry","Inspect the wrapped error to identify the underlying hashing/raw-data failure","Ensure custom Certificate implementations return valid raw bytes from Fingerprint"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// ensure the certificate decodes with valid raw bytes before AddCA\nif fp, err := c.Fingerprint(); err != nil {\n    return fmt.Errorf(\"cannot add CA %s: %w\", c.Name(), err)\n} else {\n    _ = fp\n}","typeGuard":null,"tryCatchPattern":"if err := pool.AddCA(c); err != nil {\n    if strings.Contains(err.Error(), \"could not calculate fingerprint\") {\n        log.Fatalf(\"CA %s has unusable raw data: %v\", c.Name(), err)\n    }\n    return err\n}","preventionTips":["Re-decode certificates from the original PEM rather than passing hand-built structs","Keep custom Certificate implementations' Fingerprint methods tested","Round-trip parse certificates once at load time and fail fast on errors"],"tags":["certificate","fingerprint","ca-pool"],"backgroundTag":"fingerprint-calculation-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}