{"record":{"id":"42cd5e7bfb3be499","repo":"slackhq/nebula","slug":"error-while-parsing-in-pub-s","errorCode":null,"errorMessage":"error while parsing in-pub: %s","messagePattern":"error while parsing in-pub: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":285,"sourceCode":"\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t}\n\n\tif fips140.Enforced() && curve == cert.Curve_CURVE25519 {\n\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t}\n\n\tif *sf.inPubPath != \"\" {\n\t\tvar pubCurve cert.Curve\n\t\trawPub, err := readInput(\"in-pub\", *sf.inPubPath, &claims)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while reading in-pub: %s\", err)\n\t\t}\n\n\t\tpub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing in-pub: %s\", err)\n\t\t}\n\t\tif pubCurve != curve {\n\t\t\treturn fmt.Errorf(\"curve of in-pub does not match ca\")\n\t\t}\n\t} else if isP11 {\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tpub, rawPriv = newKeypair(curve)\n\t}\n\n\tif !isStdio(*sf.outCertPath) {\n\t\tif _, err := os.Stat(*sf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing cert: %s\", *sf.outCertPath)\n\t\t}\n\t}","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L267-L303","documentation":"Wrapping error in signCert: cert.UnmarshalPublicKeyFromPEM could not parse the -in-pub bytes as a public key, or it succeeded but pubCurve differs from the requested signing curve. Cause appended via %s.","triggerScenarios":"Thrown at cmd/nebula-cert/sign.go:285 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply a valid public key PEM from nebula-cert keygen","Generate the key on the same curve as the CA (or pass the matching -curve)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}