{"record":{"id":"5c250a0c58133fbc","repo":"slackhq/nebula","slug":"error-while-creating-pkcs-11-client-w","errorCode":null,"errorMessage":"error while creating PKCS#11 client: %w","messagePattern":"error while creating PKCS#11 client: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":259,"sourceCode":"\t\t\t}\n\t\t}\n\t}\n\n\tvar curve cert.Curve\n\tvar pub, rawPriv []byte\n\tvar p11Client *pkclient.PKClient\n\n\tif isP11 {\n\t\tswitch *cf.curve {\n\t\tcase \"P256\":\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve for PKCS#11: %s\", *cf.curve)\n\t\t}\n\n\t\tp11Client, err = pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tswitch *cf.curve {\n\t\tcase \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\":\n\t\t\tif fips140.Enforced() {\n\t\t\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t\t\t}\n\t\t\tcurve = cert.Curve_CURVE25519\n\t\t\tpub, rawPriv, err = ed25519.GenerateKey(rand.Reader)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while generating ed25519 keys: %s\", err)","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L241-L277","documentation":"pkclient.FromUrl() failed to create the PKCS#11 client (module load, URL parsing, or token/session setup), and the ca command wraps it with \"error while creating PKCS#11 client: %w\". The wrapped cause names the concrete failure from the pkcs11 layer.","triggerScenarios":"Running `nebula-cert ca -p11url <url>` where FromUrl errors: malformed PKCS#11 URI, missing/unloadable PKCS#11 module (.so), HSM not connected, or bad token/slot configuration.","commonSituations":"HSM not plugged in or locked, wrong PKCS#11 URI scheme/path, missing PKCS#11 shared library on the host, environment lacking PKCS11_MODULE configuration, or insufficient permissions to open the token device.","solutions":["Read the wrapped %w cause — it pinpoints URI parsing vs module loading vs session failure.","Verify the PKCS#11 URI is well-formed and points at an existing token/slot.","Ensure the PKCS#11 module shared library is installed and loadable on the host (check its path and permissions).","Confirm the HSM/token is connected, initialized, and accessible by the user running nebula-cert.","Test the token with p11tool/pkcs11-tool using the same URI to isolate the problem."],"exampleFix":"// before (missing module library)\nnebula-cert ca -name \"ca\" -p11url \"p11://token=ca\"\n\n// after (install module and pass full URI)\napt install opensc  # provides pkcs11.so\nnebula-cert ca -name \"ca\" -p11url \"p11://module=/usr/lib/softhsm/libsofthsm2.so;token=ca\"","handlingStrategy":"try-catch","validationCode":"// preflight: open the PKCS#11 module before running the CA command\n// e.g. run: pkcs11-tool --module <so> --list-slots --token-label <token>\n// and only proceed if it succeeds","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", \"-p11url\", uri, ...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error while creating PKCS#11 client\") {\n    // unwrap cause: check URI, module path, and token availability\n    return err\n}","preventionTips":["Validate the PKCS#11 URI with p11tool/pkcs11-tool before automation.","Ensure the PKCS#11 module shared library is installed and its path correct.","Check HSM connectivity and permissions in deployment health checks."],"tags":["cli","pkcs11","hsm"],"backgroundTag":"pkcs11-client-init-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}