{"record":{"id":"26f1beed8c4bdf27","repo":"slackhq/nebula","slug":"error-while-unmarshaling-pki-cert-w","errorCode":null,"errorMessage":"error while unmarshaling pki.cert: %w","messagePattern":"error while unmarshaling pki\\.cert: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":522,"sourceCode":"\t\treturn rawKey, cert.Curve_P256, true, nil\n\t} else {\n\t\tpemPrivateKey, err = os.ReadFile(privPathOrPEM)\n\t\tif err != nil {\n\t\t\treturn nil, curve, false, fmt.Errorf(\"unable to read pki.key file %s: %s\", privPathOrPEM, err)\n\t\t}\n\t\trawKey, _, curve, err = cert.UnmarshalPrivateKeyFromPEM(pemPrivateKey)\n\t\tif err != nil {\n\t\t\treturn nil, curve, false, fmt.Errorf(\"error while unmarshaling pki.key %s: %s\", privPathOrPEM, err)\n\t\t}\n\t}\n\n\treturn\n}\n\nfunc loadCertificate(b []byte) (cert.Certificate, []byte, error) {\n\tc, b, err := cert.UnmarshalCertificateFromPEM(b)\n\tif err != nil {\n\t\treturn nil, b, fmt.Errorf(\"error while unmarshaling pki.cert: %w\", err)\n\t}\n\n\tif c.Expired(time.Now()) {\n\t\treturn nil, b, fmt.Errorf(\"nebula certificate for this host is expired\")\n\t}\n\n\tif len(c.Networks()) == 0 {\n\t\treturn nil, b, fmt.Errorf(\"no networks encoded in certificate\")\n\t}\n\n\tif c.IsCA() {\n\t\treturn nil, b, fmt.Errorf(\"host certificate is a CA certificate\")\n\t}\n\n\treturn c, b, nil\n}\n\nfunc loadCAPoolFromConfig(l *slog.Logger, c *config.C) (*cert.CAPool, error) {","sourceCodeStart":504,"sourceCodeEnd":540,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L504-L540","documentation":"loadCertificate wraps failures from cert.UnmarshalCertificateFromPEM: the pki.cert PEM bytes could not be decoded into a Nebula certificate. The library throws it so config-time cert problems surface with the underlying parser error preserved via %w.","triggerScenarios":"newCertStateFromConfig is called and pki.cert contains no valid PEM block, a non-certificate PEM type, data in a format the bundled cert library cannot parse (e.g. newer/older cert format version), or concatenated garbage around the PEM block.","commonSituations":"pki.cert points to the CA file or a public key instead of the host cert; cert issued by a newer nebula-cert version with an incompatible format; file truncated by bad transfer; whitespace/BOM corruption.","solutions":["Confirm pki.cert contains a '-----BEGIN NEBULA ... CERTIFICATE-----' block for this host, not the CA cert","Regenerate/re-export the certificate with a nebula-cert version compatible with this binary","Re-transfer the file in binary-safe mode (scp) and check it is not truncated","Run 'nebula-cert print' on the file to validate it parses outside nebula"],"exampleFix":"// before\npki:\n  cert: /etc/nebula/ca.crt   # CA cert supplied as host cert\n// after\npki:\n  cert: /etc/nebula/host.crt # host certificate issued by the CA","handlingStrategy":"validation","validationCode":"certBytes, err := os.ReadFile(cfg.PKI.Cert)\nif err != nil { return err }\nif !bytes.Contains(certBytes, []byte(\"-----BEGIN\")) {\n    return fmt.Errorf(\"%s is not a PEM certificate\", cfg.PKI.Cert)\n}","typeGuard":"func isPEMCertificate(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    return blk != nil && strings.Contains(blk.Type, \"CERTIFICATE\")\n}","tryCatchPattern":"c, rest, err := cert.UnmarshalCertificateFromPEM(certBytes)\nif err != nil {\n    return fmt.Errorf(\"error while unmarshaling pki.cert: %w\", err)\n}","preventionTips":["Keep ca.crt and host.crt distinct; template configs with correct paths","Use 'nebula-cert print' to validate certs before deployment","Transfer PEM files in text-safe mode to avoid truncation","Match nebula-cert version to the nebula binary version"],"tags":["pki","certificate","config"],"backgroundTag":"certificate-parse-error","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}