{"record":{"id":"3c25d16742d1ae24","repo":"slackhq/nebula","slug":"error-while-getting-public-key-w","errorCode":null,"errorMessage":"error while getting public key: %w","messagePattern":"error while getting public key: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/keygen.go","lineNumber":97,"sourceCode":"\tvar claims ioClaims\n\tif err := reserveOutputs(&claims,\n\t\t\"out-key\", *cf.outKeyPath,\n\t\t\"out-pub\", *cf.outPubPath,\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tif isP11 {\n\t\tp11Client, err := pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key: %w\", err)\n\t\t}\n\t} else {\n\t\terr = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\terr = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-pub: %s\", err)\n\t}\n\n\treturn nil\n}\n\nfunc keygenSummary() string {\n\treturn \"keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`\"\n}","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/keygen.go#L79-L115","documentation":"nebula-cert's PKCS#11 key generation failed when retrieving the public key from the token via p11Client.GetPubKey(). The client was created successfully, but the HSM could not return the public half of the key; the underlying error is wrapped with %w.","triggerScenarios":"Running `nebula-cert keygen -pkcs11 ...` where GetPubKey fails: the key object does not exist on the token, the session is not logged in, the slot/token was removed mid-operation, or the mechanism/key attributes are wrong.","commonSituations":"Key label/ID in the PKCS#11 URL not matching an object on the token; PIN not supplied or wrong so C_Login fails; token unplugged or HSM session expired; hardware that does not expose the public key for the requested key.","solutions":["Verify the key label/ID in the -pkcs11-url matches an object present on the token (pkcs11-tool -O).","Supply a correct PIN/token login in the PKCS#11 URL or environment.","Reconnect the token/HSM and retry the keygen command.","Read the wrapped cause in the message to distinguish login failure from missing object."],"exampleFix":"// before\nnebula-cert keygen -pkcs11 -pkcs11-url \"pkcs11:token=mytoken\" ...\n// after (pin included)\nnebula-cert keygen -pkcs11 -pkcs11-url \"pkcs11:token=mytoken;pin=1234\" ...","handlingStrategy":"retry","validationCode":"#!/bin/sh\n# Confirm the token and key object exist before keygen\npkcs11-tool --module \"$MODULE\" --list-objects | grep -q \"$KEY_LABEL\" \\\n  || { echo \"key object $KEY_LABEL not on token\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Include a valid PIN in the PKCS#11 URL so login succeeds.","Confirm the key label/ID exists on the token before keygen.","Keep the token connected for the duration of the operation.","Retry transient token/session failures with backoff."],"tags":["pkcs11","hsm","cli","keypair"],"backgroundTag":"pkcs11-key-retrieval-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}