{"record":{"id":"8feb03de2ca60fa9","repo":"slackhq/nebula","slug":"error-while-parsing-crt-w","errorCode":null,"errorMessage":"error while parsing crt: %w","messagePattern":"error while parsing crt: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/verify.go","lineNumber":72,"sourceCode":"\tdefer caReader.Close()\n\n\tcaPool, err := cert.NewCAPoolFromPEMReader(caReader)\n\tif err != nil && !errors.Is(err, cert.ErrExpired) {\n\t\treturn fmt.Errorf(\"error while adding ca cert to pool: %w\", err)\n\t}\n\n\trawCert, err := readInput(\"crt\", *vf.certPath, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to read crt: %w\", err)\n\t}\n\tvar errs []error\n\tfor {\n\t\tif len(rawCert) == 0 {\n\t\t\tbreak\n\t\t}\n\t\tc, extra, err := cert.UnmarshalCertificateFromPEM(rawCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing crt: %w\", err)\n\t\t}\n\t\trawCert = extra\n\t\t_, err = caPool.VerifyCertificate(time.Now(), c)\n\t\tif err != nil {\n\t\t\tswitch {\n\t\t\tcase errors.Is(err, cert.ErrCaNotFound):\n\t\t\t\terrs = append(errs, fmt.Errorf(\"error while verifying certificate v%d %s with issuer %s: %w\", c.Version(), c.Name(), c.Issuer(), err))\n\t\t\tdefault:\n\t\t\t\terrs = append(errs, fmt.Errorf(\"error while verifying certificate %+v: %w\", c, err))\n\t\t\t}\n\t\t}\n\t}\n\n\treturn errors.Join(errs...)\n}\n\nfunc verifySummary() string {\n\treturn \"verify <flags>: verifies a certificate isn't expired and was signed by a trusted authority.\"","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/verify.go#L54-L90","documentation":"Each PEM block from the -crt input is parsed with cert.UnmarshalCertificateFromPEM. If the bytes are not a valid Nebula certificate PEM, the parse error is wrapped with this message. Note the loop expects potentially multiple concatenated certificates; the first unparseable block aborts.","triggerScenarios":"UnmarshalCertificateFromPEM(rawCert) fails: the file holds a standard X.509 PEM instead of a Nebula certificate, is empty, contains a private key, or the PEM block is corrupt.","commonSituations":"Pointing -crt at an X.509 cert from another PKI instead of a nebula-cert-signed certificate; pointing at the CA file by mistake; passing a key file; truncated or base64-mangled cert from copy/paste.","solutions":["Confirm the file was generated by nebula-cert (header should be a Nebula PEM block, not 'BEGIN CERTIFICATE' X.509 from another CA)","Regenerate the certificate with nebula-cert sign","Check you are not pointing -crt at the CA or key file","Verify the file was not truncated or altered in transfer"],"exampleFix":"// before\n./nebula-cert verify -ca ca.crt -crt openssl-host.pem   # X.509, not Nebula\n// after\n./nebula-cert sign -ca ca.crt -key ca.key -name host -out-crt host.crt\n./nebula-cert verify -ca ca.crt -crt host.crt","handlingStrategy":"validation","validationCode":"import (\"os\"; \"strings\")\nfunc looksLikeNebulaCert(path string) error {\n    b, err := os.ReadFile(path)\n    if err != nil { return err }\n    s := string(b)\n    if strings.Contains(s, \"PRIVATE KEY\") {\n        return errors.New(\"passed a key file, not a certificate\")\n    }\n    if !strings.Contains(s, \"-----BEGIN\") {\n        return errors.New(\"not a PEM certificate\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"verify\", args...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error while parsing crt\") {\n    log.Printf(\"not a valid Nebula cert: %s\", out)\n}","preventionTips":["Only pass certificates generated by nebula-cert sign to -crt","Do not confuse the CA file or key file with the host cert","Check file integrity after transfer (checksums)","Inspect the PEM header if unsure what a file contains"],"tags":["go","cli","pem","certificate-parsing"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}