{"record":{"id":"8c7283818a5aac81","repo":"slackhq/nebula","slug":"errinvalidpublickey","errorCode":"ErrInvalidPublicKey","errorMessage":"invalid public key","messagePattern":"invalid public key","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":17,"sourceCode":"package cert\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n)\n\nvar (\n\tErrBadFormat                  = errors.New(\"bad wire format\")\n\tErrRootExpired                = errors.New(\"root certificate is expired\")\n\tErrExpired                    = errors.New(\"certificate is expired\")\n\tErrNotCA                      = errors.New(\"certificate is not a CA\")\n\tErrNotSelfSigned              = errors.New(\"certificate is not self-signed\")\n\tErrBlockListed                = errors.New(\"certificate is in the block list\")\n\tErrFingerprintMismatch        = errors.New(\"certificate fingerprint did not match\")\n\tErrSignatureMismatch          = errors.New(\"certificate signature did not match\")\n\tErrInvalidPublicKey           = errors.New(\"invalid public key\")\n\tErrInvalidPrivateKey          = errors.New(\"invalid private key\")\n\tErrPublicPrivateCurveMismatch = errors.New(\"public key does not match private key curve\")\n\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")\n\tErrInvalidPEMCertificateBanner       = errors.New(\"bytes did not contain a proper certificate banner\")\n\tErrInvalidPEMX25519PublicKeyBanner   = errors.New(\"bytes did not contain a proper X25519 public key banner\")\n\tErrInvalidPEMX25519PrivateKeyBanner  = errors.New(\"bytes did not contain a proper X25519 private key banner\")\n\tErrInvalidPEMEd25519PublicKeyBanner  = errors.New(\"bytes did not contain a proper Ed25519 public key banner\")\n\tErrInvalidPEMEd25519PrivateKeyBanner = errors.New(\"bytes did not contain a proper Ed25519 private key banner\")\n\n\tErrNoPeerStaticKey = errors.New(\"no peer static key was present\")\n\tErrNoPayload       = errors.New(\"provided payload was empty\")","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L1-L35","documentation":"ErrInvalidPublicKey is returned by the certificate validate step (v1 cert/cert_v1.go:336 and v2 cert/cert_v2.go:395) when the certificate carries an empty public key. A Nebula certificate must embed the host's Curve25519/ed25519 public key used for tunnel encryption.","triggerScenarios":"Calling validate on a certificate where len(publicKey) == 0 — typically a cert signed without a public key, or constructed/unmarshaled from malformed input that dropped the key field.","commonSituations":"Custom signing code creating certificates without embedding a public key; corrupted serialization stripping the key field; version mismatch where the key field is read from the wrong offset/field during unmarshal.","solutions":["Regenerate the certificate with nebula-cert sign / keygen so a valid key pair is embedded.","Verify the key generation step succeeded and the public key was passed to the certificate builder before signing.","Check that unmarshal used the correct certificate version path so the pubkey field is parsed.","Validate len(cert.PublicKey()) > 0 right after unmarshal to fail fast with a clearer message."],"exampleFix":"// before\ncert := cert.NewNebulaCertificate(details) // details.publicKey never set\ncert.Sign(caKey)\n\n// after\ndetails.PublicKey = pubkeyFromKeypair // 32-byte curve25519 key\ncert := cert.NewNebulaCertificate(details)\ncert.Sign(caKey)","handlingStrategy":"validation","validationCode":"if len(c.PublicKey()) == 0 {\n    return fmt.Errorf(\"certificate %s has no embedded public key; re-sign with a keypair\", c.Name())\n}","typeGuard":"func hasPublicKey(c cert.Certificate) bool {\n    return len(c.PublicKey()) > 0\n}","tryCatchPattern":"if err := c.Validate(); errors.Is(err, cert.ErrInvalidPublicKey) {\n    return fmt.Errorf(\"regenerate the certificate: public key missing\")\n}","preventionTips":["Always set details.PublicKey from a freshly generated keypair before signing.","Validate() certificates immediately after unmarshal.","Use the correct version-specific unmarshal path so the pubkey field parses."],"tags":["certificate","public-key","validation"],"backgroundTag":"invalid-public-key","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}