{"record":{"id":"a5de35719395e792","repo":"tailscale/tailscale","slug":"the-tailnet-lock-key-of-the-current-node-must-be-o","errorCode":null,"errorMessage":"the tailnet lock key of the current node must be one of the trusted keys during initialization","messagePattern":"the tailnet lock key of the current node must be one of the trusted keys during initialization","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/tailscale/cli/tailnet-lock.go","lineNumber":141,"sourceCode":"\tkeys, disablementValues, err := parseTLArgs(args, true, true)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Common mistake: Not specifying the current node's key as one of the trusted keys.\n\tfoundSelfKey := false\n\tfor _, k := range keys {\n\t\tkeyID, err := k.ID()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif bytes.Equal(keyID, st.PublicKey.KeyID()) {\n\t\t\tfoundSelfKey = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !foundSelfKey {\n\t\treturn errors.New(\"the tailnet lock key of the current node must be one of the trusted keys during initialization\")\n\t}\n\n\tfmt.Println(\"You are initializing tailnet lock with the following trusted signing keys:\")\n\tfor _, k := range keys {\n\t\tfmt.Printf(\" - tlpub:%x (%s key)\\n\", k.Public, k.Kind.String())\n\t}\n\tfmt.Println()\n\n\tif !nlInitArgs.confirm {\n\t\tfmt.Printf(\"%d disablement secrets will be generated.\\n\", nlInitArgs.numDisablements)\n\t\tif nlInitArgs.disablementForSupport {\n\t\t\tfmt.Println(\"A disablement secret will be generated and transmitted to Tailscale support.\")\n\t\t}\n\n\t\tgenSupportFlag := \"\"\n\t\tif nlInitArgs.disablementForSupport {\n\t\t\tgenSupportFlag = \"--gen-disablement-for-support \"\n\t\t}","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/tailscale/tailscale/blob/cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042/cmd/tailscale/cli/tailnet-lock.go#L123-L159","documentation":"During `tailscale lock init`, the CLI parses the supplied trusted keys and verifies that one of them matches the current node's own tailnet-lock key (st.PublicKey.KeyID()). If no key's ID equals the node key ID, initialization aborts, because the node signing the init update must itself be trusted or the tailnet would lock out its own signer.","triggerScenarios":"Running `tailscale lock init tlpub:<other-node-key>` where the listed keys do not include the key of the node running the command; computing the wrong KeyID (k.ID() error aside, mismatch of bytes); pasting trusted keys from a different node.","commonSituations":"Admin initializes lock from node A but only lists node B's signing key; keys copied from documentation or another tailnet; key typo when transcribing tlpub values.","solutions":["Get this node's key from `tailscale lock status` (or `tailscale lock init` help text) and include its tlpub in the init arguments","Re-run: `tailscale lock init tlpub:<this-node> tlpub:<others...>`","Prefer running init on the node whose key you intend to trust first"],"exampleFix":"# before\n$ tailscale lock init tlpub:<node-b-key>\n# after\n$ tailscale lock init tlpub:<node-a-key-this-node> tlpub:<node-b-key>","handlingStrategy":"validation","validationCode":"st, _ := localClient.TailnetLockStatus(ctx)\nselfID := st.PublicKey.KeyID()\nfor _, k := range keys {\n    id, _ := k.ID()\n    if bytes.Equal(id, selfID) {\n        return nil // ok to init\n    }\n}\nreturn errors.New(\"current node key missing from init key set\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include the output of `tailscale lock status` local key in init args","Run init from the node whose key you list first","Automate key collection instead of hand-copying tlpub strings"],"tags":["tailnet-lock","cli","key-management","validation"],"backgroundTag":null,"analyzedSha":"cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042","analyzedAt":"2026-08-15T19:58:31.583Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}