{"record":{"id":"2414bd4b99498a6d","repo":"slackhq/nebula","slug":"error-while-unmarshaling-cert-s","errorCode":null,"errorMessage":"error while unmarshaling cert: %s","messagePattern":"error while unmarshaling cert: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/print.go","lineNumber":69,"sourceCode":"\trawCert, err := readInput(\"path\", *pf.path, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to read cert; %s\", err)\n\t}\n\n\t// When the QR is going to stdout, suppress the human-readable text/json\n\t// output so the binary stream is not contaminated.\n\tqrToStdout := isStdio(*pf.outQRPath)\n\n\tvar c cert.Certificate\n\tvar qrBytes []byte\n\tpart := 0\n\n\tvar jsonCerts []cert.Certificate\n\n\tfor {\n\t\tc, rawCert, err = cert.UnmarshalCertificateFromPEM(rawCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while unmarshaling cert: %s\", err)\n\t\t}\n\n\t\tif !qrToStdout {\n\t\t\tif *pf.json {\n\t\t\t\tjsonCerts = append(jsonCerts, c)\n\t\t\t} else {\n\t\t\t\t_, _ = out.Write([]byte(c.String()))\n\t\t\t\t_, _ = out.Write([]byte(\"\\n\"))\n\t\t\t}\n\t\t}\n\n\t\tif *pf.outQRPath != \"\" {\n\t\t\tb, err := c.MarshalPEM()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while marshalling cert to PEM: %s\", err)\n\t\t\t}\n\t\t\tqrBytes = append(qrBytes, b...)\n\t\t}","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/print.go#L51-L87","documentation":"printCert loops calling cert.UnmarshalCertificateFromPEM on the remaining raw bytes; a parse failure is wrapped as \"error while unmarshaling cert\". It means the input bytes were read but are not a valid Nebula PEM certificate (bad PEM framing or corrupted/unsupported certificate body). The loop also allows a bundle of concatenated certs, and it fails on the first invalid one.","triggerScenarios":"`nebula-cert print -path f` where f contains a private key, a truncated PEM, HTML/text instead of PEM, or a PEM of a different type (e.g. a CA key instead of a cert); passing an encrypted or foreign-format certificate the parser can't decode","commonSituations":"accidentally printing the .key file instead of the .crt; a cert downloaded/copy-pasted with mangled whitespace or missing BEGIN/END lines; certs issued by a newer format/version not supported by the installed nebula-cert","solutions":["Confirm the input is a certificate PEM (starts with -----BEGIN NEBULA ... CERTIFICATE-----), not a key","Re-copy the certificate ensuring the full PEM including BEGIN/END lines is intact","Check binary/version compatibility: upgrade nebula-cert if the cert was issued by a newer format","Regenerate the certificate with `nebula-cert ca`/`sign` if the file is corrupted"],"exampleFix":"// before\nnebula-cert print -path ./host.key      # this is a private key\n// after\nnebula-cert print -path ./host.crt","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(path)\nif err != nil { return err }\nif !strings.Contains(string(data), \"-----BEGIN\") || !strings.Contains(string(data), \"CERTIFICATE-----\") {\n    return fmt.Errorf(\"%s does not look like a certificate PEM\", path)\n}","typeGuard":"func looksLikeCertPEM(data []byte) bool {\n    return strings.Contains(string(data), \"-----BEGIN\") && strings.Contains(string(data), \"CERTIFICATE-----\")\n}","tryCatchPattern":"if err := printCert(args, out, errOut); err != nil {\n    if strings.Contains(err.Error(), \"error while unmarshaling cert\") {\n        log.Fatalf(\"input is not a valid Nebula certificate PEM: %v\", err)\n    }\n}","preventionTips":["Confirm you pass the .crt file, not the .key file","Copy PEMs including full BEGIN/END lines without mangling","Match nebula-cert version to the cert format version that issued it","Sanity-check the file with head -1 (should show a CERTIFICATE BEGIN line)"],"tags":["parsing","pem","certificate","nebula-cert"],"backgroundTag":"pem-parse-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}