{"record":{"id":"2b6b659842c6ae5d","repo":"slackhq/nebula","slug":"no-pki-key-path-or-pem-data-provided","errorCode":null,"errorMessage":"no pki.key path or PEM data provided","messagePattern":"no pki\\.key path or PEM data provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pki.go","lineNumber":306,"sourceCode":"\t}\n\n\tif cs.v2Cert != nil {\n\t\tb, err := cs.v2Cert.MarshalJSON()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tmsg = append(msg, b)\n\t}\n\n\treturn json.Marshal(msg)\n}\n\nfunc newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) {\n\tvar err error\n\n\tprivPathOrPEM := c.GetString(\"pki.key\", \"\")\n\tif privPathOrPEM == \"\" {\n\t\treturn nil, errors.New(\"no pki.key path or PEM data provided\")\n\t}\n\n\trawKey, curve, isPkcs11, err := loadPrivateKey(privPathOrPEM)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar rawCert []byte\n\n\tpubPathOrPEM := c.GetString(\"pki.cert\", \"\")\n\tif pubPathOrPEM == \"\" {\n\t\treturn nil, errors.New(\"no pki.cert path or PEM data provided\")\n\t}\n\n\tif strings.Contains(pubPathOrPEM, \"-----BEGIN\") {\n\t\trawCert = []byte(pubPathOrPEM)\n\t\tpubPathOrPEM = \"<inline>\"\n","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L288-L324","documentation":"newCertStateFromConfig builds the node's certificate state from the pki config section. Before any key loading happens it reads the 'pki.key' setting; if that string is empty there is nothing to parse, so it returns this error immediately. It means the nebula config lacks any private key, either as a file path or inline PEM.","triggerScenarios":"Calling reloadCerts/newCertStateFromConfig with a config.C where c.GetString(\"pki.key\", \"\") returns \"\" — i.e. the config has no pki.key entry at all, or it is set to an empty string.","commonSituations":"Fresh config templates missing the pki block; YAML key typo (pki: key: mis-indented so it isn't under pki); config generated programmatically without setting pki.key; key section stripped when templating configs.","solutions":["Set pki.key in the config to the path of the private key file (e.g. /etc/nebula/host.key) or to inline PEM beginning '-----BEGIN ... PRIVATE KEY-----'.","Verify the YAML structure nests key/cert/ca under pki: and that no empty-string value overrides it.","If building config in code, call c.SetString(\"pki.key\", ...) before invoking Start/reloadCerts."],"exampleFix":"// before\npki:\n  cert: /etc/nebula/host.crt\n// after\npki:\n  cert: /etc/nebula/host.crt\n  key: /etc/nebula/host.key","handlingStrategy":"validation","validationCode":"if c.GetString(\"pki.key\", \"\") == \"\" {\n    return errors.New(\"config is missing pki.key: set a key file path or inline PEM\")\n}","typeGuard":null,"tryCatchPattern":"if err := reloadCerts(); err != nil {\n    if strings.Contains(err.Error(), \"no pki.key\") {\n        log.Fatal(\"nebula config has no pki.key set; cannot start\")\n    }\n}","preventionTips":["Always include pki.key in config templates and validate configs at deploy time","Prefer file paths over env-templated PEM so empty env vars fail loudly at file-read time","Run a config lint step that checks pki.key, pki.cert, and pki.ca are all non-empty before start"],"tags":["pki","config","nebula","missing-key"],"backgroundTag":"missing-pki-key","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}