{"record":{"id":"b81a78db39e271f1","repo":"slackhq/nebula","slug":"error-while-writing-out-crt-s","errorCode":null,"errorMessage":"error while writing out-crt: %s","messagePattern":"error while writing out-crt: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":361,"sourceCode":"\t\t\t}\n\t\t} else {\n\t\t\tb = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)\n\t\t}\n\n\t\terr = writeOutput(*cf.outKeyPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tb, err = c.MarshalPEM()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t}\n\n\terr = writeOutput(*cf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *cf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}\n\n\t\terr = writeOutput(*cf.outQRPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-qr: %s\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc caSummary() string {","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L343-L379","documentation":"nebula-cert's `ca` subcommand failed while writing the generated CA certificate PEM to the path given via the -out-crt flag. Marshalling succeeded but writeOutput to disk (or stdout) failed; the underlying error is embedded in the message.","triggerScenarios":"Running `nebula-cert ca` where writeOutput(*cf.outCertPath, b, 0600, out) fails: missing parent directory, permission denied, disk full, or path is a directory.","commonSituations":"Typo in -out-crt path; read-only filesystem or container; -out-crt pointing at an existing directory; out of disk space after generating a large key.","solutions":["Verify the -out-crt path's parent directory exists and is writable.","Ensure the -out-crt path does not point at an existing directory.","Check available disk space (df -h).","Run from a writable directory or supply an absolute writable path."],"exampleFix":"// before\nnebula-cert ca -name org -out-crt /etc/nebula\n// after (path must be a file, not a dir)\nnebula-cert ca -name org -out-crt /etc/nebula/ca.crt","handlingStrategy":"try-catch","validationCode":"#!/bin/sh\nCRT_PATH=\"$OUT_CRT_PATH\"\n[ -d \"$CRT_PATH\" ] && { echo \"$CRT_PATH is a directory\" >&2; exit 1; }\n[ -w \"$(dirname \"$CRT_PATH\")\" ] || { echo \"dir not writable\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"err = writeOutput(*cf.outCertPath, b, 0600, out)\nif err != nil {\n    return fmt.Errorf(\"error while writing out-crt: %s\", err)\n}","preventionTips":["Point -out-crt at a file, never a directory.","Pre-create and permission the output directory.","Monitor free disk space in CI runners.","Use absolute paths in automation."],"tags":["filesystem","cli","ca"],"backgroundTag":"file-write-permission-denied","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}