{"record":{"id":"5d0095ab9f2ec428","repo":"slackhq/nebula","slug":"no-passphrase-specified-remove-encrypt-flag-to-w","errorCode":null,"errorMessage":"no passphrase specified, remove -encrypt flag to write out-key in plaintext","messagePattern":"no passphrase specified, remove -encrypt flag to write out-key in plaintext","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":240,"sourceCode":"\t\tpassphrase = []byte(os.Getenv(\"NEBULA_CA_PASSPHRASE\"))\n\t\tif len(passphrase) == 0 {\n\t\t\tfor i := 0; i < 5; i++ {\n\t\t\t\terrOut.Write([]byte(\"Enter passphrase: \"))\n\t\t\t\tpassphrase, err = pr.ReadPassword()\n\n\t\t\t\tif err == ErrNoTerminal {\n\t\t\t\t\treturn fmt.Errorf(\"out-key must be encrypted interactively\")\n\t\t\t\t} else if err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error reading passphrase: %s\", err)\n\t\t\t\t}\n\n\t\t\t\tif len(passphrase) > 0 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif len(passphrase) == 0 {\n\t\t\t\treturn fmt.Errorf(\"no passphrase specified, remove -encrypt flag to write out-key in plaintext\")\n\t\t\t}\n\t\t}\n\t}\n\n\tvar curve cert.Curve\n\tvar pub, rawPriv []byte\n\tvar p11Client *pkclient.PKClient\n\n\tif isP11 {\n\t\tswitch *cf.curve {\n\t\tcase \"P256\":\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve for PKCS#11: %s\", *cf.curve)\n\t\t}\n\n\t\tp11Client, err = pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L222-L258","documentation":"After five failed attempts to capture a passphrase (or an empty one each time), nebula-cert ca refuses to continue: an empty passphrase cannot be used with -encrypt, so it tells the user to drop the -encrypt flag to write the out-key in plaintext instead.","triggerScenarios":"Running `nebula-cert ca -encrypt` and pressing Enter (empty input) five consecutive times at the \"Enter passphrase:\" prompt.","commonSituations":"Users unaware a passphrase is mandatory, accidental Enter presses, or automated input feeding blank lines into the prompt.","solutions":["Type a non-empty passphrase at the prompt and confirm it.","Remove the -encrypt flag if you intentionally want a plaintext out-key.","Fix automation scripts that pipe blank lines into the command's stdin."],"exampleFix":"// before (automation feeding blanks)\nprintf '\\n\\n\\n\\n\\n' | nebula-cert ca -name \"ca\" -encrypt\n\n// after\nnebula-cert ca -name \"ca\" -encrypt  # type passphrase interactively\n// or drop encryption:\nnebula-cert ca -name \"ca\"","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", \"-encrypt\", ...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"no passphrase specified\") {\n    // supply a non-empty passphrase or drop -encrypt\n    return err\n}","preventionTips":["Always enter a non-empty passphrase when -encrypt is set.","Do not script -encrypt with piped/blank input.","Remove -encrypt when a plaintext key is intended."],"tags":["cli","passphrase","input-validation"],"backgroundTag":"empty-passphrase-rejected","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}