{"record":{"id":"bb479be88c782734","repo":"slackhq/nebula","slug":"error-while-marshalling-cert-to-pem-s","errorCode":null,"errorMessage":"error while marshalling cert to PEM: %s","messagePattern":"error while marshalling cert to PEM: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/print.go","lineNumber":84,"sourceCode":"\tfor {\n\t\tc, rawCert, err = cert.UnmarshalCertificateFromPEM(rawCert)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while unmarshaling cert: %s\", err)\n\t\t}\n\n\t\tif !qrToStdout {\n\t\t\tif *pf.json {\n\t\t\t\tjsonCerts = append(jsonCerts, c)\n\t\t\t} else {\n\t\t\t\t_, _ = out.Write([]byte(c.String()))\n\t\t\t\t_, _ = out.Write([]byte(\"\\n\"))\n\t\t\t}\n\t\t}\n\n\t\tif *pf.outQRPath != \"\" {\n\t\t\tb, err := c.MarshalPEM()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while marshalling cert to PEM: %s\", err)\n\t\t\t}\n\t\t\tqrBytes = append(qrBytes, b...)\n\t\t}\n\n\t\tif rawCert == nil || len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == \"\" {\n\t\t\tbreak\n\t\t}\n\n\t\tpart++\n\t}\n\n\tif *pf.json && !qrToStdout {\n\t\tb, _ := json.Marshal(jsonCerts)\n\t\t_, _ = out.Write(b)\n\t\t_, _ = out.Write([]byte(\"\\n\"))\n\t}\n\n\tif *pf.outQRPath != \"\" {","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/print.go#L66-L102","documentation":"When -out-qr is set, printCert marshals each parsed certificate to PEM via c.MarshalPEM() and concatenates the bytes for QR encoding; failure is wrapped with this message. It means the in-memory certificate object could not be re-serialized to PEM, which is a rare internal/encoding failure rather than a file problem.","triggerScenarios":"`nebula-cert print -path cert.crt -out-qr qr.png` where c.MarshalPEM() returns an error for one of the certificates in the input (malformed certificate structure that parsed but cannot re-encode)","commonSituations":"processing unusual or edge-case certificates (e.g. very large or oddly-structured certs) while generating a QR bundle; multi-cert bundles where one member fails to re-encode","solutions":["Upgrade nebula-cert to the latest version (encoding fixes land upstream)","Test printing without -out-qr to isolate whether the failure is QR/PEM marshalling or general printing","Regenerate the offending certificate from the CA","Report upstream with the certificate structure if a valid cert consistently fails"],"exampleFix":"// before\nnebula-cert print -path cert.crt -out-qr qr.png   # fails marshalling\n// after\nnebula-cert print -path cert.crt                  # confirm basic print works, then retry QR with updated binary","handlingStrategy":"try-catch","validationCode":"if err := printCert(args, out, errOut); err == nil {\n    // basic print works; QR PEM marshalling path is safe to attempt\n}","typeGuard":null,"tryCatchPattern":"if err := printCert(args, out, errOut); err != nil {\n    if strings.Contains(err.Error(), \"error while marshalling cert to PEM\") {\n        log.Printf(\"PEM re-encode failed, printing without -out-qr: %v\", err)\n        // fallback: run again without -out-qr\n    }\n}","preventionTips":["Keep nebula-cert updated so encoding bugs are fixed","Test printing without -out-qr first when processing unusual certs","Avoid QR-encoding very large or multi-cert bundles","Regenerate suspicious certificates from the CA"],"tags":["encoding","pem","qrcode","nebula-cert"],"backgroundTag":"pem-marshal-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}