{"record":{"id":"9223a0a8eb10de6c","repo":"slackhq/nebula","slug":"error-while-writing-out-key-s","errorCode":null,"errorMessage":"error while writing out-key: %s","messagePattern":"error while writing out-key: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":350,"sourceCode":"\t\t}\n\t} else {\n\t\tc, err = t.Sign(nil, curve, rawPriv)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing: %s\", err)\n\t\t}\n\n\t\tif *cf.encryption {\n\t\t\tb, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while encrypting out-key: %s\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tb = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)\n\t\t}\n\n\t\terr = writeOutput(*cf.outKeyPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tb, err = c.MarshalPEM()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t}\n\n\terr = writeOutput(*cf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *cf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L332-L368","documentation":"nebula-cert's `ca` subcommand failed while writing the generated CA private key to the path given via the -out-key flag. The key PEM was already produced (or generated by PKCS#11), but writing it to disk or stdout failed. The underlying OS/library error is embedded in the message.","triggerScenarios":"Running `nebula-cert ca` where writeOutput(*cf.outKeyPath, b, 0600, out) fails: the -out-key path's parent directory does not exist, the process lacks write permission, or the file cannot be created.","commonSituations":"Typo in -out-key path; running in a read-only container or CI working directory; non-root user writing to a root-owned directory; SELinux/AppArmor denying file creation.","solutions":["Check that the directory named by -out-key exists and is writable by the current user (mkdir -p / chmod).","Run nebula-cert from a writable working directory or use an absolute -out-key path.","Re-run with elevated permissions only if the target location truly requires it.","Inspect the embedded underlying error in the message for the exact OS reason."],"exampleFix":"// before\nnebula-cert ca -name org -out-key /etc/nebula/ca.key\n// after (directory may not exist)\nmkdir -p /etc/nebula && nebula-cert ca -name org -out-key /etc/nebula/ca.key","handlingStrategy":"try-catch","validationCode":"#!/bin/sh\nKEY_DIR=$(dirname \"$OUT_KEY_PATH\")\n[ -d \"$KEY_DIR\" ] || mkdir -p \"$KEY_DIR\"\n[ -w \"$KEY_DIR\" ] || { echo \"cannot write $KEY_DIR\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"if err := writeOutput(outKeyPath, b, 0600, out); err != nil {\n    return fmt.Errorf(\"error while writing out-key: %s\", err)\n}\n// caller: inspect the wrapped error to distinguish permission vs missing dir","preventionTips":["Create the output directory before running nebula-cert.","Run as a user with write access to the target directory.","Use absolute paths in scripts and CI.","Check disk space and mount flags (rw) in containers."],"tags":["filesystem","cli","ca"],"backgroundTag":"file-write-permission-denied","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}