{"record":{"id":"445c35b4711b8d64","repo":"slackhq/nebula","slug":"error-while-creating-pkcs-11-client-w-445c35","errorCode":null,"errorMessage":"error while creating PKCS#11 client: %w","messagePattern":"error while creating PKCS#11 client: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/keygen.go","lineNumber":90,"sourceCode":"\t\t\tpub, rawPriv = p256Keypair()\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve: %s\", *cf.curve)\n\t\t}\n\t}\n\n\tvar claims ioClaims\n\tif err := reserveOutputs(&claims,\n\t\t\"out-key\", *cf.outKeyPath,\n\t\t\"out-pub\", *cf.outPubPath,\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tif isP11 {\n\t\tp11Client, err := pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key: %w\", err)\n\t\t}\n\t} else {\n\t\terr = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\terr = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-pub: %s\", err)\n\t}","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/keygen.go#L72-L108","documentation":"nebula-cert failed to construct the PKCS#11 client from the -pkcs11 URL (pkclient.FromUrl) during key generation. The underlying error is wrapped with %w, so the root cause (bad URL, missing module, token issues) is embedded.","triggerScenarios":"Running `nebula-cert keygen -pkcs11 -pkcs11-url <url>` where the URL is malformed, the PKCS#11 module cannot be loaded, or the client cannot initialize against the token/slot.","commonSituations":"Missing or misconfigured PKCS#11 module path in the URL; HSM not connected or daemon (e.g. p11-kit/pkcs11-proxy) not running; wrong slot/PIN encoded in the URL; module shared-object not installed in the container image.","solutions":["Check the -pkcs11-url syntax and that it points to a reachable, existing PKCS#11 module.","Verify the HSM/smartcard is connected and the PKCS#11 shared library is installed (ldd on the module).","Test the module independently (pkcs11-tool --module <lib> -L) to list slots.","Read the wrapped cause in the message for the exact failure (module load vs token login)."],"exampleFix":"// before\nnebula-cert keygen -pkcs11 -pkcs11-url /usr/lib/softhsm.so2 ...\n// after (correct module filename)\nnebula-cert keygen -pkcs11 -pkcs11-url /usr/lib/softhsm/libsofthsm2.so ...","handlingStrategy":"validation","validationCode":"#!/bin/sh\nMODULE=$(echo \"$P11_URL\" | sed 's/^pkcs11://;s/?.*//')\n[ -f \"$MODULE\" ] || { echo \"PKCS#11 module $MODULE not found\" >&2; exit 1; }\npkcs11-tool --module \"$MODULE\" -L >/dev/null 2>&1 || { echo \"module init failed\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify the PKCS#11 module path and URL syntax before running keygen.","Test the module with pkcs11-tool -L independently.","Ensure the HSM is connected and its daemon is running.","Install the module library in container images."],"tags":["pkcs11","hsm","cli","initialization"],"backgroundTag":"pkcs11-client-init-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}