{"record":{"id":"55657c5e05d5fb8d","repo":"slackhq/nebula","slug":"error-while-signing-with-pkcs-11-w","errorCode":null,"errorMessage":"error while signing with PKCS#11: %w","messagePattern":"error while signing with PKCS#11: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":331,"sourceCode":"\tif !isP11 && !isStdio(*cf.outKeyPath) {\n\t\tif _, err := os.Stat(*cf.outKeyPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA key: %s\", *cf.outKeyPath)\n\t\t}\n\t}\n\n\tif !isStdio(*cf.outCertPath) {\n\t\tif _, err := os.Stat(*cf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA cert: %s\", *cf.outCertPath)\n\t\t}\n\t}\n\n\tvar c cert.Certificate\n\tvar b []byte\n\n\tif isP11 {\n\t\tc, err = t.SignWith(nil, curve, p11Client.SignASN1)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tc, err = t.Sign(nil, curve, rawPriv)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing: %s\", err)\n\t\t}\n\n\t\tif *cf.encryption {\n\t\t\tb, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while encrypting out-key: %s\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tb = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)\n\t\t}\n\n\t\terr = writeOutput(*cf.outKeyPath, b, 0600, out)\n\t\tif err != nil {","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L313-L349","documentation":"Wraps a failure from t.SignWith(nil, curve, p11Client.SignASN1) when signing the CA certificate through the PKCS#11 token in `nebula-cert ca`. The public key was fetched fine, but the HSM refused or failed the ASN.1 signature operation. The pkclient error is preserved via %w.","triggerScenarios":"nebula-cert ca -p11url ... where SignASN1 fails: wrong/missing PIN for the private key object, key is extract-only restricted or usage flags disallow signing, token removed mid-operation, or session died after GetPubKey.","commonSituations":"HSM key has CKA_SIGN=false; token locked after bad PIN; PKCS#11 module crashed or session timed out; HSM in a state where private-key operations are denied (e.g. FIPS policy mismatch).","solutions":["Check the wrapped pkclient error for the PKCS#11 return code (CKR_*)","Confirm the key object has signing enabled (CKA_SIGN=true) and the PIN/session is valid","Re-run with a correct pin in the -p11url; re-authenticate the token","Verify the token stays connected and the PKCS#11 module works (test with pkcs11-tool --sign)"],"exampleFix":"// before\nnebula-cert ca -p11url \"pkcs11:token=mytoken;object=ca-key\" -name \"my ca\"\n// after\nnebula-cert ca -p11url \"pkcs11:token=mytoken;object=ca-key?pin=<pin>\" -name \"my ca\"  # key must have CKA_SIGN=true","handlingStrategy":"try-catch","validationCode":"// before running: confirm the key supports signing\n// pkcs11-tool --module <module> -O   # check CKA_SIGN=true on the key object","typeGuard":"func isP11SigningErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"error while signing with PKCS#11\")\n}","tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", \"-p11url\", url, ...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error while signing with PKCS#11\") {\n\tlog.Printf(\"HSM signing failed: %s — check pin, CKA_SIGN flag, session\", out)\n\treturn fmt.Errorf(\"HSM sign failure: %s\", out)\n}","preventionTips":["Provision HSM keys with CKA_SIGN enabled","Include a valid pin in the pkcs11 URL and rotate it with credential policy","Test signing once (pkcs11-tool --sign) before production issuance","Monitor token/session health; reconnect on CKR_SESSION_CLOSED errors"],"tags":["pkcs11","hsm","signing","crypto"],"backgroundTag":"pkcs11-sign-operation-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}