{"record":{"id":"62f4009c58334864","repo":"slackhq/nebula","slug":"invalid-curve-for-pkcs-11-s","errorCode":null,"errorMessage":"invalid curve for PKCS#11: %s","messagePattern":"invalid curve for PKCS#11: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":254,"sourceCode":"\t\t\t\t}\n\t\t\t}\n\n\t\t\tif len(passphrase) == 0 {\n\t\t\t\treturn fmt.Errorf(\"no passphrase specified, remove -encrypt flag to write out-key in plaintext\")\n\t\t\t}\n\t\t}\n\t}\n\n\tvar curve cert.Curve\n\tvar pub, rawPriv []byte\n\tvar p11Client *pkclient.PKClient\n\n\tif isP11 {\n\t\tswitch *cf.curve {\n\t\tcase \"P256\":\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve for PKCS#11: %s\", *cf.curve)\n\t\t}\n\n\t\tp11Client, err = pkclient.FromUrl(*cf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tswitch *cf.curve {\n\t\tcase \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\":\n\t\t\tif fips140.Enforced() {\n\t\t\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L236-L272","documentation":"When a PKCS#11 token is used (-pkcs11/-p11url), nebula-cert ca only supports the P256 curve. Any other -curve value (e.g. 25519) is rejected with \"invalid curve for PKCS#11: %s\" because the PKCS#11 client implementation only implements P-256 key generation.","triggerScenarios":"Running `nebula-cert ca -p11url <url> -curve 25519` (or any curve string other than exactly \"P256\") while PKCS#11 mode is enabled.","commonSituations":"Users whose HSM/setup defaults to Curve 25519 passing their usual -curve flag alongside PKCS#11 options, typos like p256/P-256 (case/format sensitive).","solutions":["Pass -curve P256 (exact spelling) when using PKCS#11.","Remove the PKCS#11 flags if you want a non-P256 curve and software key generation.","Check for case/format typos: only the literal string \"P256\" is accepted."],"exampleFix":"// before\nnebula-cert ca -name \"ca\" -p11url \"p11://...\" -curve 25519\n\n// after\nnebula-cert ca -name \"ca\" -p11url \"p11://...\" -curve P256","handlingStrategy":"validation","validationCode":"if usingPKCS11 && *curve != \"P256\" {\n    return fmt.Errorf(\"PKCS#11 requires -curve P256, got %s\", *curve)\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", args...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"invalid curve for PKCS#11\") {\n    // retry with -curve P256 or without PKCS#11 flags\n    return err\n}","preventionTips":["Always pair PKCS#11 flags with -curve P256 exactly (case-sensitive).","Document that 25519 is unsupported for PKCS#11 in team runbooks.","Validate flag combinations in wrapper scripts before exec."],"tags":["cli","pkcs11","curve"],"backgroundTag":"unsupported-curve-for-pkcs11","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}