{"record":{"id":"4b64fdb842e9a91c","repo":"slackhq/nebula","slug":"no-certificates-found-in-pki-cert","errorCode":null,"errorMessage":"no certificates found in pki.cert","messagePattern":"no certificates found in pki\\.cert","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pki.go","lineNumber":365,"sourceCode":"\t\t\t\treturn nil, fmt.Errorf(\"v1 certificate already found in pki.cert\")\n\t\t\t}\n\t\t\tv1 = crt\n\t\tcase cert.Version2:\n\t\t\tif v2 != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"v2 certificate already found in pki.cert\")\n\t\t\t}\n\t\t\tv2 = crt\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unknown certificate version %v\", crt.Version())\n\t\t}\n\n\t\tif len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == \"\" {\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif v1 == nil && v2 == nil {\n\t\treturn nil, errors.New(\"no certificates found in pki.cert\")\n\t}\n\n\tuseInitiatingVersion := uint32(1)\n\tif v1 == nil {\n\t\t// The only condition that requires v2 as the default is if only a v2 certificate is present\n\t\t// We do this to avoid having to configure it specifically in the config file\n\t\tuseInitiatingVersion = 2\n\t}\n\n\trawInitiatingVersion := c.GetUint32(\"pki.initiating_version\", useInitiatingVersion)\n\tvar initiatingVersion cert.Version\n\tswitch rawInitiatingVersion {\n\tcase 1:\n\t\tif v1 == nil {\n\t\t\treturn nil, fmt.Errorf(\"can not use pki.initiating_version 1 without a v1 certificate in pki.cert\")\n\t\t}\n\t\tinitiatingVersion = cert.Version1\n\tcase 2:","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L347-L383","documentation":"newCertStateFromConfig parses the pki.cert data (supporting v1 and v2 nebula certificates). If neither a v1 nor a v2 certificate could be parsed out of the provided data, this error is returned. Unlike error 101, the pki.cert setting was non-empty but its contents yielded no certificates.","triggerScenarios":"pki.cert points to a file or inline data that parses to zero certificates: empty/truncated file, garbage or wrong-format data (e.g. a private key, a JSON blob), or only whitespace after PEM stripping.","commonSituations":"Cert file accidentally truncated or zero bytes after a failed copy; pointing pki.cert at the key file or CA file by mistake; cert generated by an incompatible tool; newline/BOM corruption from a bad editor or secret manager.","solutions":["Inspect the file at pki.cert and confirm it contains a valid PEM block ('-----BEGIN CERTIFICATE-----' ... '-----END CERTIFICATE-----') and is non-empty.","Re-copy or re-issue the certificate with nebula-cert (nebula-cert print can validate it).","Ensure pki.cert points to the host certificate, not the key or CA file."],"exampleFix":"// before\npki:\n  cert: /etc/nebula/host.key   # wrong file\n// after\npki:\n  cert: /etc/nebula/host.crt   # contains BEGIN CERTIFICATE block","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(certPath)\nif err != nil || !bytes.Contains(data, []byte(\"-----BEGIN CERTIFICATE-----\")) {\n    return fmt.Errorf(\"%s does not contain a PEM certificate\", certPath)\n}","typeGuard":null,"tryCatchPattern":"if err := reloadCerts(); err != nil {\n    if strings.Contains(err.Error(), \"no certificates found in pki.cert\") {\n        log.Fatalf(\"pki.cert (%s) contains no valid certificates\", certPath)\n    }\n}","preventionTips":["Validate certificates with `nebula-cert print -path host.crt` after provisioning","Verify file checksums/sizes after copying certs to hosts","Never point pki.cert at the key or CA file; keep distinct filenames"],"tags":["pki","certificate","nebula","invalid-pem"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}