{"record":{"id":"74ba9b51640f1ae7","repo":"slackhq/nebula","slug":"invalid-curve-for-pkcs-11-s-74ba9b","errorCode":null,"errorMessage":"invalid curve for PKCS#11: %s","messagePattern":"invalid curve for PKCS#11: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/keygen.go","lineNumber":61,"sourceCode":"\tif !isP11 {\n\t\tif err = mustFlagString(\"out-key\", cf.outKeyPath); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else if *cf.outKeyPath != \"\" {\n\t\treturn newHelpErrorf(\"cannot set -out-key with -pkcs11\")\n\t}\n\tif err = mustFlagString(\"out-pub\", cf.outPubPath); err != nil {\n\t\treturn err\n\t}\n\n\tvar pub, rawPriv []byte\n\tvar curve cert.Curve\n\tif isP11 {\n\t\tswitch *cf.curve {\n\t\tcase \"P256\":\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve for PKCS#11: %s\", *cf.curve)\n\t\t}\n\t} else {\n\t\tswitch *cf.curve {\n\t\tcase \"25519\", \"X25519\", \"Curve25519\", \"CURVE25519\":\n\t\t\tif fips140.Enforced() {\n\t\t\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t\t\t}\n\t\t\tpub, rawPriv = x25519Keypair()\n\t\t\tcurve = cert.Curve_CURVE25519\n\t\tcase \"P256\":\n\t\t\tpub, rawPriv = p256Keypair()\n\t\t\tcurve = cert.Curve_P256\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve: %s\", *cf.curve)\n\t\t}\n\t}\n\n\tvar claims ioClaims","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/keygen.go#L43-L79","documentation":"nebula-cert's `keytext`/key generation path rejected the -curve value because PKCS#11 mode only supports P256. When -pkcs11 is set, any curve other than \"P256\" returns this error before any key material is generated.","triggerScenarios":"Running `nebula-cert keygen -pkcs11 ...` with -curve set to 25519/X25519/Curve25519/CURVE25519 (or any value other than P256).","commonSituations":"Reusing a non-PKCS#11 keygen command line (which defaults to Curve25519) after adding the -pkcs11 flag; HSM hardware that only supports 25519; copying an older script that omitted -curve P256.","solutions":["Add `-curve P256` to the keygen command when using -pkcs11.","Remove -pkcs11 if local (software) key generation was intended.","Verify the HSM supports P256 before choosing PKCS#11 mode.","Note Curve25519 is additionally blocked under FIPS 140 enforcement, so P256 is the only valid PKCS#11 curve."],"exampleFix":"// before\nnebula-cert keygen -pkcs11 -curve 25519 -out-key host.key -out-pub host.pub\n// after\nnebula-cert keygen -pkcs11 -curve P256 -out-key host.key -out-pub host.pub","handlingStrategy":"validation","validationCode":"#!/bin/sh\nif [ -n \"$P11\" ] && [ \"$CURVE\" != \"P256\" ]; then\n  echo \"PKCS#11 requires -curve P256\" >&2\n  exit 1\nfi","typeGuard":"func validP11Curve(curve string) bool {\n    return curve == \"P256\"\n}","tryCatchPattern":null,"preventionTips":["Always pair -pkcs11 with -curve P256.","Remember Curve25519 is disallowed for PKCS#11 (and under FIPS 140-only).","Validate the HSM supports P256 before automating keygen."],"tags":["pkcs11","curve","cli","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}