{"record":{"id":"5978f58a82f54f21","repo":"slackhq/nebula","slug":"error-while-adding-ca-cert-to-pool-w","errorCode":null,"errorMessage":"error while adding ca cert to pool: %w","messagePattern":"error while adding ca cert to pool: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/verify.go","lineNumber":58,"sourceCode":"\t}\n\n\tvar claims ioClaims\n\tif err := reserveInputs(&claims,\n\t\t\"ca\", *vf.caPath,\n\t\t\"crt\", *vf.certPath,\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tcaReader, err := openInput(\"ca\", *vf.caPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while reading ca: %w\", err)\n\t}\n\tdefer caReader.Close()\n\n\tcaPool, err := cert.NewCAPoolFromPEMReader(caReader)\n\tif err != nil && !errors.Is(err, cert.ErrExpired) {\n\t\treturn fmt.Errorf(\"error while adding ca cert to pool: %w\", err)\n\t}\n\n\trawCert, err := readInput(\"crt\", *vf.certPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to read crt: %w\", err)\n\t}\n\tvar errs []error\n\tfor {\n\t\tif len(rawCert) == 0 {\n\t\t\tbreak\n\t\t}\n\t\tc, extra, err := cert.UnmarshalCertificateFromPEM(rawCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing crt: %w\", err)\n\t\t}\n\t\trawCert = extra\n\t\t_, err = caPool.VerifyCertificate(time.Now(), c)\n\t\tif err != nil {","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/verify.go#L40-L76","documentation":"The opened CA reader is parsed with cert.NewCAPoolFromPEMReader. If parsing fails with anything other than cert.ErrExpired (expired CAs are tolerated and reported later), verify wraps the error with this message. It indicates malformed or unparseable CA PEM data.","triggerScenarios":"NewCAPoolFromPEMReader returns an error that is not ErrExpired: the CA file contains no valid PEM certificate blocks, corrupt/truncated PEM, or certificates that fail to unmarshal.","commonSituations":"CA file downloaded as HTML error page instead of PEM; concatenating the wrong file (e.g. a host cert as CA); PEM with Windows line-ending or encoding damage; empty CA file.","solutions":["Confirm the CA file contains valid 'BEGIN CERTIFICATE' PEM blocks (openssl x509 -in ca.pem -noout)","Re-copy/re-download the CA in PEM format","Check that the file is a CA certificate, not a leaf cert or private key","Inspect the wrapped inner error for the exact parse failure"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import (\"os\"; \"strings\")\nfunc looksLikePEM(path string) error {\n    b, err := os.ReadFile(path)\n    if err != nil { return err }\n    if !strings.Contains(string(b), \"-----BEGIN\") {\n        return errors.New(\"no PEM blocks in CA file\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"verify\", args...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error while adding ca cert to pool\") {\n    log.Printf(\"CA PEM invalid: %s\", out)\n}","preventionTips":["Validate CA PEM with openssl x509 before use","Ensure you copied the CA, not a leaf cert or key","Beware of truncated/HTML-downloaded files; check first and last lines of the PEM"],"tags":["go","cli","pem","ca","certificate-parsing"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}