{"record":{"id":"1ee8b7b05aaea8ba","repo":"slackhq/nebula","slug":"error-while-reading-ca-crt-s","errorCode":null,"errorMessage":"error while reading ca-crt: %s","messagePattern":"error while reading ca-crt: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":178,"sourceCode":"\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif len(passphrase) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cannot open encrypted ca-key without passphrase\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tcurve, caKey, _, err = cert.DecryptAndUnmarshalSigningPrivateKey(passphrase, rawCAKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while parsing encrypted ca-key: %s\", err)\n\t\t\t}\n\t\t} else if err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing ca-key: %s\", err)\n\t\t}\n\t}\n\n\trawCACert, err := readInput(\"ca-crt\", *sf.caCertPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while reading ca-crt: %s\", err)\n\t}\n\n\tcaCert, _, err := cert.UnmarshalCertificateFromPEM(rawCACert)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while parsing ca-crt: %s\", err)\n\t}\n\n\tif !isP11 {\n\t\tif err := caCert.VerifyPrivateKey(curve, caKey); err != nil {\n\t\t\treturn fmt.Errorf(\"refusing to sign, root certificate does not match private key\")\n\t\t}\n\t}\n\n\tif caCert.Expired(time.Now()) {\n\t\treturn fmt.Errorf(\"ca certificate is expired\")\n\t}\n\n\tif version == 0 {","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L160-L196","documentation":"Wraps an error from readInput while loading the CA certificate file (ca-crt) during nebula-cert sign. Unlike the ca-key branch, the raw ca-crt is read unconditionally after key handling, so this fires when the CA cert path (-ca-crt) is wrong, the file is missing, unreadable, or empty. The wrapped readInput error names the underlying OS cause; the cert is never parsed, so signing cannot proceed.","triggerScenarios":"Thrown at cmd/nebula-cert/sign.go:178 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the -ca-crt path exists and is readable","Check file permissions and that no stdin/pipe redirection was intended"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}