{"record":{"id":"862dbe5a6087ffdf","repo":"slackhq/nebula","slug":"certificate-contained-a-network-assignment-outside","errorCode":null,"errorMessage":"certificate contained a network assignment outside the limitations of the signing ca: %s","messagePattern":"certificate contained a network assignment outside the limitations of the signing ca: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/ca_pool.go","lineNumber":321,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"certificate contained a group not present on the signing ca: %s\", g)\n\t\t\t}\n\t\t}\n\t}\n\n\t// If the signer has a limited set of ip ranges to issue from make sure the cert only contains a subset\n\tsigningNetworks := signer.Networks()\n\tif len(signingNetworks) > 0 {\n\t\tfor _, certNetwork := range networks {\n\t\t\tfound := false\n\t\t\tfor _, signingNetwork := range signingNetworks {\n\t\t\t\tif signingNetwork.Contains(certNetwork.Addr()) && signingNetwork.Bits() <= certNetwork.Bits() {\n\t\t\t\t\tfound = true\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif !found {\n\t\t\t\treturn fmt.Errorf(\"certificate contained a network assignment outside the limitations of the signing ca: %s\", certNetwork.String())\n\t\t\t}\n\t\t}\n\t}\n\n\t// If the signer has a limited set of subnet ranges to issue from make sure the cert only contains a subset\n\tsigningUnsafeNetworks := signer.UnsafeNetworks()\n\tif len(signingUnsafeNetworks) > 0 {\n\t\tfor _, certUnsafeNetwork := range unsafeNetworks {\n\t\t\tfound := false\n\t\t\tfor _, caNetwork := range signingUnsafeNetworks {\n\t\t\t\tif caNetwork.Contains(certUnsafeNetwork.Addr()) && caNetwork.Bits() <= certUnsafeNetwork.Bits() {\n\t\t\t\t\tfound = true\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif !found {\n\t\t\t\treturn fmt.Errorf(\"certificate contained an unsafe network assignment outside the limitations of the signing ca: %s\", certUnsafeNetwork.String())","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/ca_pool.go#L303-L339","documentation":"If the signing CA restricts Networks (VPN address ranges it may issue), each network prefix on the signed certificate must be contained within one of the CA's prefixes (same address inside, cert prefix bits >= CA prefix bits). This error names the cert network prefix that falls outside the CA's allowed ranges.","triggerScenarios":"CheckCAConstraints(signer, sub) where a prefix in sub.Networks() is not covered by any signer.Networks() prefix; SignWith requesting a Networks assignment outside the CA's limits; verify() after signature validation.","commonSituations":"Host config requests an IP outside the CA's subnet (e.g. CA issues only 10.0.0.0/24 but cert claims 10.1.0.0/24); cert requests a shorter (larger) prefix than the CA allows; IPv4/IPv6 family mismatch between CA and cert networks.","solutions":["Assign the host an IP inside one of the CA's allowed network ranges","Widen the CA's Networks list (re-issue CA) to include the requested range","Request a more specific prefix that fits within a CA prefix"],"exampleFix":"// before\nopts.Networks = []netip.Prefix{netip.MustParsePrefix(\"10.1.0.5/24\")} // outside CA 10.0.0.0/24\n// after\nopts.Networks = []netip.Prefix{netip.MustParsePrefix(\"10.0.0.5/24\")} // inside CA range","handlingStrategy":"validation","validationCode":"for _, n := range sub.Networks() {\n    covered := false\n    for _, ca := range signer.Networks() {\n        if ca.Contains(n.Addr()) && ca.Bits() <= n.Bits() {\n            covered = true\n            break\n        }\n    }\n    if !covered {\n        return fmt.Errorf(\"network %s outside CA limits\", n)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Issue host IPs only from ranges the CA is configured for","Match IP families (v4/v6) between CA and certs","Never request prefixes broader (fewer bits) than the CA's","Check prefix containment in cert-generation tooling"],"tags":["certificate","network","ca-constraints","netip"],"backgroundTag":"certificate-constraint-violation","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}