{"record":{"id":"4a537b7861d452c2","repo":"slackhq/nebula","slug":"refusing-to-sign-root-certificate-does-not-match","errorCode":null,"errorMessage":"refusing to sign, root certificate does not match private key","messagePattern":"refusing to sign, root certificate does not match private key","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":188,"sourceCode":"\t\t\t}\n\t\t} else if err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing ca-key: %s\", err)\n\t\t}\n\t}\n\n\trawCACert, err := readInput(\"ca-crt\", *sf.caCertPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while reading ca-crt: %s\", err)\n\t}\n\n\tcaCert, _, err := cert.UnmarshalCertificateFromPEM(rawCACert)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while parsing ca-crt: %s\", err)\n\t}\n\n\tif !isP11 {\n\t\tif err := caCert.VerifyPrivateKey(curve, caKey); err != nil {\n\t\t\treturn fmt.Errorf(\"refusing to sign, root certificate does not match private key\")\n\t\t}\n\t}\n\n\tif caCert.Expired(time.Now()) {\n\t\treturn fmt.Errorf(\"ca certificate is expired\")\n\t}\n\n\tif version == 0 {\n\t\tversion = caCert.Version()\n\t}\n\n\t// if no duration is given, expire one second before the root expires\n\tif *sf.duration <= 0 {\n\t\t*sf.duration = time.Until(caCert.NotAfter()) - time.Second*1\n\t}\n\n\tif *sf.networks != \"\" {\n\t\tfor _, rs := range strings.Split(*sf.networks, \",\") {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L170-L206","documentation":"Fatal refusal in signCert: caCert.VerifyPrivateKey(curve, caKey) failed, meaning the supplied CA signing key does not pair with the CA certificate (wrong key, wrong curve, or mismatched keypair). Signing is deliberately aborted rather than producing a certificate no peer will trust; the underlying cause is dropped from the message.","triggerScenarios":"Thrown at cmd/nebula-cert/sign.go:188 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the private key that matches the CA certificate","Re-check that ca-key and ca-crt came from the same nebula-cert ca invocation","If the key is on PKCS#11, verify the p11 URL points to the right key slot"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}