{"record":{"id":"ab73822b41ea587f","repo":"slackhq/nebula","slug":"unable-to-read-cert-s","errorCode":null,"errorMessage":"unable to read cert; %s","messagePattern":"unable to read cert; (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/print.go","lineNumber":53,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := mustFlagString(\"path\", pf.path); err != nil {\n\t\treturn err\n\t}\n\n\tvar claims ioClaims\n\tif err := reserveInputs(&claims, \"path\", *pf.path); err != nil {\n\t\treturn err\n\t}\n\tif err := reserveOutputs(&claims, \"out-qr\", *pf.outQRPath); err != nil {\n\t\treturn err\n\t}\n\n\trawCert, err := readInput(\"path\", *pf.path, &claims)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to read cert; %s\", err)\n\t}\n\n\t// When the QR is going to stdout, suppress the human-readable text/json\n\t// output so the binary stream is not contaminated.\n\tqrToStdout := isStdio(*pf.outQRPath)\n\n\tvar c cert.Certificate\n\tvar qrBytes []byte\n\tpart := 0\n\n\tvar jsonCerts []cert.Certificate\n\n\tfor {\n\t\tc, rawCert, err = cert.UnmarshalCertificateFromPEM(rawCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while unmarshaling cert: %s\", err)\n\t\t}\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/print.go#L35-L71","documentation":"printCert reads the certificate file (or stdin in stdio mode) via readInput(\"path\", *pf.path, &claims); any failure is wrapped as \"unable to read cert\". It means the -path argument could not be resolved to bytes: file missing, unreadable, empty, or stdin unavailable. The underlying OS/reader error is appended after the semicolon.","triggerScenarios":"`nebula-cert print -path /some/cert.crt` where the file does not exist, lacks read permission, is empty, or the stdio/stdin input mode fails (e.g. no piped input when -path is omitted and stdio requested)","commonSituations":"wrong path passed to -path; typo in filename; running print without piping input while relying on stdin; container images missing the mounted cert; permissions after switching users","solutions":["Verify the file exists at the -path value (ls -l)","Check read permissions on the certificate file","If using stdio mode, confirm the PEM is actually piped into stdin","Use an absolute path instead of a relative one","Re-export/regenerate the certificate if the file is empty or truncated"],"exampleFix":"// before\nnebula-cert print -path ./crt.crt   # file is actually at ./certs/crt.crt\n// after\nnebula-cert print -path ./certs/crt.crt","handlingStrategy":"validation","validationCode":"st, err := os.Stat(*pf.path)\nif err != nil { return fmt.Errorf(\"cert file missing: %w\", err) }\nif st.IsDir() || st.Size() == 0 { return fmt.Errorf(\"cert file %q is empty\", *pf.path) }\nif f, err := os.Open(*pf.path); err == nil { f.Close() }","typeGuard":null,"tryCatchPattern":"if err := printCert(args, out, errOut); err != nil {\n    if strings.HasPrefix(err.Error(), \"unable to read cert\") {\n        log.Fatalf(\"check -path %q exists and is readable: %v\", *pf.path, err)\n    }\n}","preventionTips":["Verify the -path value with ls before running","Use absolute paths in scripts","When relying on stdin/stdio, confirm the PEM is actually piped in","Mount/copy the cert into containers before invoking print"],"tags":["filesystem","file-read","nebula-cert"],"backgroundTag":"file-not-found","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}