{"record":{"id":"900afc7b08514483","repo":"slackhq/nebula","slug":"failed-to-find-private-key-for-deriving-w","errorCode":null,"errorMessage":"failed to find private key for deriving: %w","messagePattern":"failed to find private key for deriving: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkclient/pkclient_cgo.go","lineNumber":78,"sourceCode":"\t\treturn nil, fmt.Errorf(\"failed to open session on slot %d\", slotId)\n\t}\n\n\tif len(pin) != 0 {\n\t\terr = client.session.Login(pin)\n\t\tif err != nil {\n\t\t\t// ignore \"already logged in\"\n\t\t\tif !errors.Is(err, pkcs11.Error(256)) {\n\t\t\t\t_ = client.session.Close()\n\t\t\t\treturn nil, fmt.Errorf(\"unable to login. error: %w\", err)\n\t\t\t}\n\t\t}\n\t}\n\n\t// Make sure the hsm has a private key for deriving\n\tclient.privKeyObj, err = client.findDeriveKey(client.id, client.label, true)\n\tif err != nil {\n\t\t_ = client.Close() //log out, close session, destroy module\n\t\treturn nil, fmt.Errorf(\"failed to find private key for deriving: %w\", err)\n\t}\n\n\treturn client, nil\n}\n\n// Close cleans up properly and logs out\nfunc (c *PKClient) Close() error {\n\tvar err error = nil\n\tif c.session != nil {\n\t\t_ = c.session.Logout() //if logout fails, we still want to close\n\t\terr = c.session.Close()\n\t}\n\n\tc.module.Destroy()\n\treturn err\n}\n\n// Try to find a suitable key on the hsm for key derivation","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pkclient/pkclient_cgo.go#L60-L96","documentation":"pkclient.New() opens a PKCS#11 session, logs in, and then calls findDeriveKey to locate the HSM object holding the private key used for ECDH derivation. If no matching private key object exists in the token for the given id/label, the client is logged out and closed and this error wraps the underlying lookup failure.","triggerScenarios":"Calling pkclient.New(hsmPath, slotId, pin, id, label) when the token contains no private key matching the supplied CKA_ID and/or CKA_LABEL, or findDeriveKey fails (e.g. search template matches nothing, object is not CKA_DERIVE=true).","commonSituations":"Wrong id/label configured in the nebula cert vs what's stored on the HSM; key was generated without the DERIVE attribute; key exists in a different slot; provisioning script never imported the private key; smartcard/HSM was re-initialized wiping objects.","solutions":["Verify the id/label passed to New() matches the private key object on the token (use pkcs11-tool --list-objects --type privkey).","Re-generate or re-import the key with CKA_DERIVE=CK_TRUE set (required for ECDH).","Confirm the correct slot was targeted — the key may live in another slot on the same module.","Check that the HSM partition is initialized and objects were not wiped by re-initialization."],"exampleFix":"// before\nclient, err := pkclient.New(\"/usr/lib/softhsm2.so\", 0, pin, wrongID, \"nebula\")\n// after\nclient, err := pkclient.New(\"/usr/lib/softhsm2.so\", 0, pin, certID, \"nebula\") // id/label matching the HSM key object","handlingStrategy":"validation","validationCode":"// Before New(): verify a derivable private key exists on the token\nout, err := exec.Command(\"pkcs11-tool\", \"--module\", hsmPath,\n  \"--slot\", slot, \"--login\", \"--pin\", pin,\n  \"--list-objects\", \"--type\", \"privkey\", \"--id\", id).Output()\nif err != nil || !strings.Contains(string(out), \"Private Key\") {\n  return fmt.Errorf(\"no derivable private key for id %s on token\", id)\n}","typeGuard":"func hasPrivateKeyAndDeriveAttr(attrs []pkcs11.Attribute) bool {\n  for _, a := range attrs {\n    if a.Type == pkcs11.CKA_PRIVATE && len(a.Value) == 1 && a.Value[0] == 1 &&\n       a.Type == pkcs11.CKA_DERIVE { return true }\n  }\n  return false\n}","tryCatchPattern":"client, err := pkclient.New(hsmPath, slotId, pin, id, label)\nif err != nil {\n  var target *pkclient.Error\n  if errors.As(err, &target) && strings.Contains(err.Error(), \"failed to find private key\") {\n    return fmt.Errorf(\"HSM key for id=%q label=%q missing or not derivable; check provisioning: %w\", id, label, err)\n  }\n  return err\n}","preventionTips":["Provision keys with CKA_DERIVE=CK_TRUE and matching CKA_ID/CKA_LABEL used by the certificate.","Keep id/label in the nebula config in sync with the HSM object attributes (config management).","Run pkclient.Test() or pkcs11-tool --test after provisioning, before service start.","Avoid re-initializing HSM partitions without re-running the provisioning checklist."],"tags":["pkcs11","hsm","key-not-found"],"backgroundTag":"hsm-private-key-not-found","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}