{"record":{"id":"59fc8c8da7a3f078","repo":"slackhq/nebula","slug":"unable-to-read-crt-w","errorCode":null,"errorMessage":"unable to read crt: %w","messagePattern":"unable to read crt: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/verify.go","lineNumber":63,"sourceCode":"\t\t\"crt\", *vf.certPath,\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tcaReader, err := openInput(\"ca\", *vf.caPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while reading ca: %w\", err)\n\t}\n\tdefer caReader.Close()\n\n\tcaPool, err := cert.NewCAPoolFromPEMReader(caReader)\n\tif err != nil && !errors.Is(err, cert.ErrExpired) {\n\t\treturn fmt.Errorf(\"error while adding ca cert to pool: %w\", err)\n\t}\n\n\trawCert, err := readInput(\"crt\", *vf.certPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to read crt: %w\", err)\n\t}\n\tvar errs []error\n\tfor {\n\t\tif len(rawCert) == 0 {\n\t\t\tbreak\n\t\t}\n\t\tc, extra, err := cert.UnmarshalCertificateFromPEM(rawCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing crt: %w\", err)\n\t\t}\n\t\trawCert = extra\n\t\t_, err = caPool.VerifyCertificate(time.Now(), c)\n\t\tif err != nil {\n\t\t\tswitch {\n\t\t\tcase errors.Is(err, cert.ErrCaNotFound):\n\t\t\t\terrs = append(errs, fmt.Errorf(\"error while verifying certificate v%d %s with issuer %s: %w\", c.Version(), c.Name(), c.Issuer(), err))\n\t\t\tdefault:\n\t\t\t\terrs = append(errs, fmt.Errorf(\"error while verifying certificate %+v: %w\", c, err))","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/verify.go#L45-L81","documentation":"After the CA pool is built, verify reads the certificate to be checked via readInput('crt', certPath). Any failure reading that input (missing file, unreadable, stdin conflict) is wrapped as 'unable to read crt' and verification aborts.","triggerScenarios":"readInput returns an error for the -crt flag: file absent, no read permission, path is a directory, or stdin conflict when -crt is '-'.","commonSituations":"Wrong path or filename for the host certificate; cert not yet copied to the machine; running from wrong cwd; '-' used for both -ca and -crt.","solutions":["Verify the -crt path exists and is readable","Use an absolute path or cd to the directory containing the cert","Check file permissions","Ensure only one input flag uses '-' if piping via stdin"],"exampleFix":"// before\n./nebula-cert verify -ca ca.crt -crt host.crts   # typo\n// after\n./nebula-cert verify -ca ca.crt -crt host.crt","handlingStrategy":"validation","validationCode":"import \"os\"\nfunc checkReadable(path string) error {\n    if path == \"-\" { return nil }\n    f, err := os.Open(path)\n    if err != nil { return err }\n    return f.Close()\n}\n// err := checkReadable(crtPath) before invoking verify","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"verify\", args...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"unable to read crt\") {\n    log.Printf(\"cert unreadable: %s\", out)\n}","preventionTips":["Copy the host certificate to the verifying machine first","Check the exact filename and extension","Use absolute paths","Only one input flag may use '-'"],"tags":["go","cli","file-read","certificate"],"backgroundTag":"file-not-found","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}