{"record":{"id":"a832c9bfe5c7dc26","repo":"slackhq/nebula","slug":"error-while-writing-out-key-s-a832c9","errorCode":null,"errorMessage":"error while writing out-key: %s","messagePattern":"error while writing out-key: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":395,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\tcrts = append(crts, nc)\n\tdefault:\n\t\t// this should be unreachable\n\t\treturn fmt.Errorf(\"invalid version: %d\", version)\n\t}\n\n\tif !isP11 && *sf.inPubPath == \"\" {\n\t\tif !isStdio(*sf.outKeyPath) {\n\t\t\tif _, err := os.Stat(*sf.outKeyPath); err == nil {\n\t\t\t\treturn fmt.Errorf(\"refusing to overwrite existing key: %s\", *sf.outKeyPath)\n\t\t\t}\n\t\t}\n\n\t\terr = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tvar b []byte\n\tfor _, c := range crts {\n\t\tsb, err := c.MarshalPEM()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t\t}\n\t\tb = append(b, sb...)\n\t}\n\n\terr = writeOutput(*sf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *sf.outQRPath != \"\" {","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L377-L413","documentation":"After successfully signing, the freshly generated private key is written with writeOutput(-out-key, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600). If writing fails (I/O error, permissions, marshal failure), this wrapped error is returned. Note the certificate was already signed at this point, but the key never reaches disk.","triggerScenarios":"writeOutput failing while persisting the new private key: unwritable directory, full disk, permission denied on the target path, or MarshalPrivateKeyToPEM failing for the curve.","commonSituations":"-out-key pointing at a read-only or nonexistent directory; running without write permission on the path; disk quota/full volume; SELinux/AppArmor blocking file creation.","solutions":["Check that the directory of -out-key exists and is writable by the running user (mkdir -p / chmod)","Free disk space or resolve quota issues if the disk is full","Check the wrapped inner error for permission denied vs marshal failure; ensure output is not blocked by MAC policies (SELinux/AppArmor)"],"exampleFix":"// before\nnebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key /etc/nebula/missing-dir/host.key -out-cert host.crt\n// after\nmkdir -p /etc/nebula\nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key /etc/nebula/host.key -out-cert /etc/nebula/host.crt","handlingStrategy":"validation","validationCode":"# shell: verify output dir is writable before signing\nKEY_DIR=$(dirname \"$OUT_KEY\")\nmkdir -p \"$KEY_DIR\" && [ -w \"$KEY_DIR\" ] || { echo \"cannot write $KEY_DIR\"; exit 1; }\ndf -h \"$KEY_DIR\" | awk 'NR==2 && $5+0 > 95 {print \"disk nearly full\"; exit 1}'","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    if strings.Contains(err.Error(), \"error while writing out-key\") {\n        // cert may have been signed but key write failed; fix path/permissions, re-run cleanly\n    }\n    return err\n}","preventionTips":["Provision output directories with correct ownership/permissions before running sign","Monitor disk space and quotas on hosts performing batch issuance","Run as a user with write access to the key store; check SELinux/AppArmor denials in audit logs"],"tags":["filesystem","private-key","io-error","nebula"],"backgroundTag":"file-write-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}