{"record":{"id":"6bdfd6c80c51e7ca","repo":"slackhq/nebula","slug":"error-while-marshalling-certificate-s","errorCode":null,"errorMessage":"error while marshalling certificate: %s","messagePattern":"error while marshalling certificate: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":356,"sourceCode":"\n\t\tif *cf.encryption {\n\t\t\tb, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while encrypting out-key: %s\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tb = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)\n\t\t}\n\n\t\terr = writeOutput(*cf.outKeyPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tb, err = c.MarshalPEM()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t}\n\n\terr = writeOutput(*cf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *cf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}\n\n\t\terr = writeOutput(*cf.outQRPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-qr: %s\", err)\n\t\t}\n\t}","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L338-L374","documentation":"nebula-cert's `ca` subcommand failed to marshal the newly created CA certificate into PEM format via c.MarshalPEM(). This happens inside the certificate library before the cert is written out. The underlying marshalling error is embedded in the message.","triggerScenarios":"Calling `nebula-cert ca` where the constructed certificate object cannot be serialized to PEM — e.g. an internal failure encoding the certificate structure for the selected curve.","commonSituations":"Rare in practice because the cert is freshly built internally; can appear with unusual flag combinations, corrupted PKCS#11-provided public keys, or a version mismatch between nebula-cert and its certificate library.","solutions":["Retry with standard flags (e.g. default 25519 curve) to rule out exotic combinations.","Update nebula-cert to the latest version; this indicates a library-level failure.","If using PKCS#11 (-pkcs11), verify the returned public key is valid for the curve.","Report the embedded error upstream if it persists with supported flag combinations."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"b, err := c.MarshalPEM()\nif err != nil {\n    return fmt.Errorf(\"error while marshalling certificate: %s\", err)\n}","preventionTips":["Keep nebula-cert and its certificate library up to date.","Use supported flag combinations and standard curves.","Validate PKCS#11-provided public keys before building the certificate.","Report persistent marshalling failures upstream with the embedded error."],"tags":["pem","certificate","cli","serialization"],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}