{"record":{"id":"72794fa2e6a086e5","repo":"slackhq/nebula","slug":"no-certificate-state","errorCode":null,"errorMessage":"no certificate state","messagePattern":"no certificate state","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"interface.go","lineNumber":192,"sourceCode":"\t\treturn \"always\"\n\tcase recvErrorNever:\n\t\treturn \"never\"\n\tcase recvErrorPrivate:\n\t\treturn \"private\"\n\tdefault:\n\t\treturn fmt.Sprintf(\"invalid(%d)\", s)\n\t}\n}\n\nfunc NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {\n\tif c.Outside == nil {\n\t\treturn nil, errors.New(\"no outside connection\")\n\t}\n\tif c.Inside == nil {\n\t\treturn nil, errors.New(\"no inside interface (tun)\")\n\t}\n\tif c.pki == nil {\n\t\treturn nil, errors.New(\"no certificate state\")\n\t}\n\tif c.Firewall == nil {\n\t\treturn nil, errors.New(\"no firewall rules\")\n\t}\n\tif c.connectionManager == nil {\n\t\treturn nil, errors.New(\"no connection manager\")\n\t}\n\n\tif c.routines <= 1 {\n\t\tc.PinThreads = false //pinning is not useful unless there's more than one tun reader\n\t}\n\n\tcs := c.pki.getCertState()\n\tifce := &Interface{\n\t\tctx:                   ctx,\n\t\tpki:                   c.pki,\n\t\thostMap:               c.HostMap,\n\t\toutside:               c.Outside,","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/interface.go#L174-L210","documentation":"Configuration guard in NewInterface: InterfaceConfig.pki is nil, meaning no certificate/PKI state was built (e.g. pki config missing or failed to load). The interface cannot handshake or encrypt without certificates, so construction aborts.","triggerScenarios":"InterfaceConfig.pki is nil because certificate loading (ca pool + own cert/key) failed or was skipped in Main before interface creation.","commonSituations":"Bad cert/key file paths in config; unparseable or expired certificates; missing 'pki' config section; YAML/JSON struct not mapped when embedding nebula.","solutions":["Verify pki.cert, pki.key and pki.ca paths in config point to valid, readable files","Check earlier logs for certificate parse/load errors","Regenerate or reissue expired/invalid certificates with nebula-cert","Ensure the pki section is present and correctly structured in the config"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if cfg.InterfaceConfig.Pki == nil {\n    return errors.New(\"pki not loaded; check cert/key/ca paths\")\n}\n// also verify upfront:\n_, err := pki.NewPKIFromConfig(cfg.Pki) // fails fast on bad cert paths/parse errors","typeGuard":null,"tryCatchPattern":"i, err := NewInterface(ctx, c)\nif err != nil {\n    if err.Error() == \"no certificate state\" { /* fix pki config / regenerate certs */ }\n    return err\n}","preventionTips":["Validate certificate files exist and parse (nebula-cert) before startup","Check certificate expiry as part of deployment health checks","Keep the pki section present and correctly keyed in the config"],"tags":["config","pki","certificates","nebula","startup"],"backgroundTag":"missing-required-config","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}