{"record":{"id":"507155690e0f5452","repo":"slackhq/nebula","slug":"self-signed-certificates-must-have-isca-set-to-tru","errorCode":null,"errorMessage":"self signed certificates must have IsCA set to true","messagePattern":"self signed certificates must have IsCA set to true","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/sign.go","lineNumber":99,"sourceCode":"\n\tif signer != nil {\n\t\tif t.IsCA {\n\t\t\treturn nil, fmt.Errorf(\"can not sign a CA certificate with another\")\n\t\t}\n\n\t\terr := checkCAConstraints(signer, t.NotBefore, t.NotAfter, t.Groups, t.Networks, t.UnsafeNetworks)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tissuer, err := signer.Fingerprint()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error computing issuer: %v\", err)\n\t\t}\n\t\tt.issuer = issuer\n\t} else {\n\t\tif !t.IsCA {\n\t\t\treturn nil, fmt.Errorf(\"self signed certificates must have IsCA set to true\")\n\t\t}\n\t}\n\n\tvar c beingSignedCertificate\n\tswitch t.Version {\n\tcase Version1:\n\t\tc = &certificateV1{}\n\t\terr := c.fromTBSCertificate(t)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tcase Version2:\n\t\tc = &certificateV2{}\n\t\terr := c.fromTBSCertificate(t)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tdefault:","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/sign.go#L81-L117","documentation":"When SignWith is called with signer == nil (self-signing), the certificate must have IsCA set to true. A self-signed non-CA certificate would be meaningless in nebula's PKI because only CAs can sign other certs, so the library rejects this combination.","triggerScenarios":"Calling SignWith(t, nil, key) — i.e. no signer — while t.Details.IsCA is false (or via cert.Sign/standaloneSelfSign paths that skip the signer).","commonSituations":"Generating a leaf/host certificate but forgetting to supply the CA signer, or generating a root CA but forgetting to set IsCA: true in the certificate details (e.g. the nebula-cert ca command building details without the flag).","solutions":["If creating a CA, set t.Details.IsCA = true before calling SignWith with nil signer.","If creating a normal host certificate, pass the CA certificate and private key as the signer instead of nil.","In the nebula-cert CLI, ensure the -ca flow sets IsCA; check custom code that constructs NebulaCertificateDetails."],"exampleFix":"// before\nroot, err := cert.Sign(nil, key, t) // t.Details.IsCA == false\n\n// after\nt.Details.IsCA = true\nroot, err := cert.Sign(nil, key, t)","handlingStrategy":"validation","validationCode":"if signer == nil && !t.Details.IsCA {\n    return fmt.Errorf(\"self-signing requires IsCA: true\")\n}","typeGuard":null,"tryCatchPattern":"root, err := cert.Sign(nil, key, t)\nif err != nil && strings.Contains(err.Error(), \"self signed certificates must have IsCA\") {\n    // set IsCA or supply a signer\n    return err\n}","preventionTips":["Default IsCA: true in CA-creation helpers.","Never pass nil signer unless intentionally creating a root CA.","Add a unit test asserting CA creation sets IsCA."],"tags":["pki","certificate","self-signed"],"backgroundTag":"self-signed-cert-missing-ca-flag","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}