{"record":{"id":"22f78cdd4ca9d7a8","repo":"slackhq/nebula","slug":"invalid-certificate","errorCode":null,"errorMessage":"invalid certificate","messagePattern":"invalid certificate","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/sign.go","lineNumber":145,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif curve == Curve_P256 {\n\t\tsig, err = p256.Normalize(sig)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\terr = c.setSignature(sig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsc, ok := c.(Certificate)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"invalid certificate\")\n\t}\n\n\treturn sc, nil\n}\n\nfunc comparePrefix(a, b netip.Prefix) int {\n\taddr := a.Addr().Compare(b.Addr())\n\tif addr == 0 {\n\t\treturn a.Bits() - b.Bits()\n\t}\n\treturn addr\n}\n\n// findDuplicatePrefix returns an error if there is a duplicate prefix in the pre-sorted input slice sortedPrefixes\nfunc findDuplicatePrefix(sortedPrefixes []netip.Prefix) error {\n\tif len(sortedPrefixes) < 2 {\n\t\treturn nil\n\t}","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/sign.go#L127-L163","documentation":"After building and signing the concrete certificate struct, SignWith asserts the result implements the Certificate interface via a type assertion c.(Certificate). If the concrete type does not satisfy the interface, it returns \"invalid certificate\". This indicates an internal inconsistency between the version-specific certificate type and the Certificate interface contract.","triggerScenarios":"The signed concrete certificate (e.g. certificateV1/certificateV2 built in the version switch) fails the Certificate interface assertion inside SignWith — effectively only reachable with a mismatched or partially implemented certificate type.","commonSituations":"Custom forks or vendored copies of the cert package where a new version-specific certificate struct was added without implementing all Certificate interface methods, or binary/ABI mismatch after partial library upgrades.","solutions":["Ensure the concrete certificate type for the chosen version implements every method of the cert.Certificate interface.","Rebuild against a consistent version of the nebula cert package (go mod tidy / go build) to remove stale vendored code.","If you added a new version case in the switch, implement the full Certificate interface (Checksum, Marshal, Sign, Verify, etc.) for it."],"exampleFix":"// before\ntype certificateV3 struct{ /* missing Checksum() */ }\n\n// after\nfunc (c *certificateV3) Checksum() []byte { return c.checksum }\n// plus remaining Certificate interface methods","handlingStrategy":"type-guard","validationCode":"var _ cert.Certificate = (*cert.NebulaCertificate)(nil) // compile-time interface check","typeGuard":"func asCertificate(c any) (cert.Certificate, bool) {\n    sc, ok := c.(cert.Certificate)\n    return sc, ok\n}","tryCatchPattern":"root, err := cert.Sign(signer, key, t)\nif err != nil && err.Error() == \"invalid certificate\" {\n    // rebuild against a consistent cert package version\n    return err\n}","preventionTips":["Add compile-time assertions (var _ cert.Certificate = ...) for all certificate structs.","Avoid partial forks of the cert package.","Run go build/go vet after upgrading the nebula dependency to clear stale vendored code."],"tags":["pki","certificate","type-assertion"],"backgroundTag":"interface-not-implemented","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}