{"record":{"id":"4cd4d65d7de5a90c","repo":"slackhq/nebula","slug":"refusing-to-overwrite-existing-ca-cert-s","errorCode":null,"errorMessage":"refusing to overwrite existing CA cert: %s","messagePattern":"refusing to overwrite existing CA cert: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":321,"sourceCode":"\t\tGroups:         groups,\n\t\tNetworks:       networks,\n\t\tUnsafeNetworks: unsafeNetworks,\n\t\tNotBefore:      time.Now(),\n\t\tNotAfter:       time.Now().Add(*cf.duration),\n\t\tPublicKey:      pub,\n\t\tIsCA:           true,\n\t\tCurve:          curve,\n\t}\n\n\tif !isP11 && !isStdio(*cf.outKeyPath) {\n\t\tif _, err := os.Stat(*cf.outKeyPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA key: %s\", *cf.outKeyPath)\n\t\t}\n\t}\n\n\tif !isStdio(*cf.outCertPath) {\n\t\tif _, err := os.Stat(*cf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA cert: %s\", *cf.outCertPath)\n\t\t}\n\t}\n\n\tvar c cert.Certificate\n\tvar b []byte\n\n\tif isP11 {\n\t\tc, err = t.SignWith(nil, curve, p11Client.SignASN1)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tc, err = t.Sign(nil, curve, rawPriv)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing: %s\", err)\n\t\t}\n\n\t\tif *cf.encryption {","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L303-L339","documentation":"Safety guard in `nebula-cert ca`: if -out-cert-path already exists on disk (and is not stdio) the command aborts rather than replacing an existing CA certificate. Even when a new key is fine, silently swapping a CA cert would invalidate trust chains built on the old cert.","triggerScenarios":"nebula-cert ca with -out-cert-path pointing to an existing certificate file; re-running ca against the same directory, or a previous run already produced ca.crt.","commonSituations":"Re-running ca in automation; existing default ca.crt in the working directory; a previous successful or partial run left the cert behind; user intends to renew but does not realize the command never overwrites.","solutions":["Move/rename or delete the existing CA cert if replacement is intended","Supply a different -out-cert-path for the new CA","Write the cert to stdout via stdio path and redirect as needed","If renewing, use the sign/renew workflows rather than generating a new CA over the old cert"],"exampleFix":"// before\nnebula-cert ca -name \"my ca\"   # fails: ca.crt exists\n// after\nmv ca.crt ca.crt.old && nebula-cert ca -name \"my ca\"","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(outCertPath); err == nil {\n\treturn fmt.Errorf(\"cert %s exists; move it or choose another path\", outCertPath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check -out-cert-path existence before invoking ca","Run ca in a fresh/temp directory in CI and copy results on success","Never script blind re-runs of ca against a live PKI directory","Renew certs via the sign workflow instead of regenerating the CA"],"tags":["filesystem","safety","cli","overwrite-guard"],"backgroundTag":"refusing-to-overwrite-existing-file","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}