{"record":{"id":"44c5cc21c02a1ef2","repo":"slackhq/nebula","slug":"error-while-generating-qr-code-s","errorCode":null,"errorMessage":"error while generating qr code: %s","messagePattern":"error while generating qr code: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":367,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tb, err = c.MarshalPEM()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t}\n\n\terr = writeOutput(*cf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *cf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}\n\n\t\terr = writeOutput(*cf.outQRPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-qr: %s\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc caSummary() string {\n\treturn \"ca <flags>: create a self signed certificate authority\"\n}\n\nfunc caHelp(out io.Writer) {\n\tcf := newCaFlags()\n\tout.Write([]byte(\"Usage of \" + os.Args[0] + \" \" + caSummary() + \"\\n\"))","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L349-L385","documentation":"Wrapping error in nebula-cert ca when qrcode.Encode fails to render the marshalled certificate PEM into a PNG QR code. The underlying failure is included with %s; typical causes are payload too large for the requested QR size/level (long certificates at qrcode.Medium, negative size auto-fit failing).","triggerScenarios":"Running `nebula-cert ca -out-qr <path>` where the qrcode encoder rejects the payload — typically because the certificate PEM string exceeds the encoder's capacity at the chosen recovery level (Medium) and scale (-5).","commonSituations":"Very large CA certificates (long names, unusual field contents) producing PEM too long for a QR code; rare otherwise since the payload size is fixed at Medium/-5 internally.","solutions":["Shorten the CA -name / subnets to reduce certificate size.","Skip the -out-qr flag and distribute ca.crt by file instead.","Update nebula-cert in case a newer qrcode library raises capacity limits.","Use the embedded error text to confirm it is a QR capacity issue."],"exampleFix":"// before\nnebula-cert ca -name a-very-long-organization-name-with-many-details -out-qr ca-qr.png\n// after\nnebula-cert ca -name org -out-qr ca-qr.png","handlingStrategy":"validation","validationCode":"// QR capacity is bounded; keep the CA certificate small.\n// Check name length before running:\nif [ ${#CA_NAME} -gt 64 ]; then\n  echo \"CA name too long for QR output; drop -out-qr\" >&2\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit -out-qr for large certificates and distribute ca.crt as a file.","Keep CA -name short.","Treat QR output as best-effort; handle its failure separately from cert/key output."],"tags":["qrcode","cli","ca"],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}