{"record":{"id":"57d439d6337b7524","repo":"slackhq/nebula","slug":"error-while-getting-public-key-with-pkcs-11-w","errorCode":null,"errorMessage":"error while getting public key with PKCS#11: %w","messagePattern":"error while getting public key with PKCS#11: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":266,"sourceCode":"\n\tif isP11 {\n\t\tswitch *cf.curve {\n\t\tcase \"P256\":\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve for PKCS#11: %s\", *cf.curve)\n\t\t}\n\n\t\tp11Client, err = pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tswitch *cf.curve {\n\t\tcase \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\":\n\t\t\tif fips140.Enforced() {\n\t\t\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t\t\t}\n\t\t\tcurve = cert.Curve_CURVE25519\n\t\t\tpub, rawPriv, err = ed25519.GenerateKey(rand.Reader)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while generating ed25519 keys: %s\", err)\n\t\t\t}\n\t\tcase \"P256\":\n\t\t\tvar key *ecdsa.PrivateKey\n\t\t\tcurve = cert.Curve_P256\n\t\t\tkey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while generating ecdsa keys: %s\", err)","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L248-L284","documentation":"Wraps any failure from p11Client.GetPubKey() while running `nebula-cert ca` in PKCS#11 (-p11url) mode. The PKCS#11 client is created successfully but the HSM/token refused or failed to return the public key for the configured private key object. The underlying pkclient error is preserved via %w, so errors.Unwrap reveals the root cause.","triggerScenarios":"nebula-cert ca -p11url <pkcs11-url> where the URL's token/slot/pin is wrong, the referenced key object does not exist or is not accessible, the PKCS#11 module is missing/misconfigured, or the token is removed/locked between client creation and GetPubKey.","commonSituations":"HSM or smartcard not plugged in; wrong pin or slot pinned in the pkcs11 URL; key was deleted from the token; PKCS#11 module library path wrong or permissions deny access to the token device.","solutions":["Check the wrapped error (errors.Unwrap / printed detail) for the exact PKCS#11 return code","Verify the -p11url points to an existing key object on the correct token/slot","Confirm the PKCS#11 module library path and that the token is present (pkcs11-tool -L)","Re-authenticate: an expired/missing PIN or a locked session causes key lookups to fail"],"exampleFix":"// before\nnebula-cert ca -p11url \"pkcs11:token=mytoken;object=ca-key\" -name \"my ca\"\n// after\nnebula-cert ca -p11url \"pkcs11:token=mytoken;object=ca-key;pin=<correct-pin>&module-path=/usr/lib/softhsm/libsofthsm2.so\" -name \"my ca\"","handlingStrategy":"try-catch","validationCode":"// before running: confirm the token/key is reachable\n// pkcs11-tool --module <module> -L   # list slots\n// pkcs11-tool --module <module> -O   # list objects, verify 'ca-key' exists","typeGuard":"func isP11KeyLookupErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"error while getting public key with PKCS#11\")\n}","tryCatchPattern":"err := cmd.Run()\nvar p11Err *os.PathError\nif err != nil && strings.Contains(err.Error(), \"PKCS#11\") {\n\tlog.Printf(\"PKCS#11 key lookup failed: %v — check token, pin, and module path\", err)\n\treturn fmt.Errorf(\"HSM unavailable: %w\", err)\n}","preventionTips":["Validate the pkcs11 URL with pkcs11-tool before automating ca","Pin the module path and pin in a checked-in, secret-managed config","Health-check token presence before batch certificate generation","Never reuse a -p11url across tokens with different slot layouts"],"tags":["pkcs11","hsm","crypto","cli"],"backgroundTag":"pkcs11-key-lookup-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}