{"record":{"id":"c143d0fdd476a06a","repo":"slackhq/nebula","slug":"error-while-marshalling-certificate-s-c143d0","errorCode":null,"errorMessage":"error while marshalling certificate: %s","messagePattern":"error while marshalling certificate: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":403,"sourceCode":"\n\tif !isP11 && *sf.inPubPath == \"\" {\n\t\tif !isStdio(*sf.outKeyPath) {\n\t\t\tif _, err := os.Stat(*sf.outKeyPath); err == nil {\n\t\t\t\treturn fmt.Errorf(\"refusing to overwrite existing key: %s\", *sf.outKeyPath)\n\t\t\t}\n\t\t}\n\n\t\terr = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tvar b []byte\n\tfor _, c := range crts {\n\t\tsb, err := c.MarshalPEM()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t\t}\n\t\tb = append(b, sb...)\n\t}\n\n\terr = writeOutput(*sf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *sf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}\n\n\t\terr = writeOutput(*sf.outQRPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-qr: %s\", err)","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L385-L421","documentation":"signCert in the nebula-cert CLI fails while serializing a generated Nebula certificate to PEM. After signing, each certificate is marshalled with MarshalPEM(); if that returns an error (indicating a certificate failed to encode), the error is wrapped with this message and returned, aborting the sign operation before any output file is written.","triggerScenarios":"c.MarshalPEM() returns a non-nil error while iterating over the certificates produced by signCert — e.g. the underlying cert struct is in a state that cannot be PEM-encoded.","commonSituations":"A bug or version mismatch between the signing code and the cert library; an internal failure marshalling a just-signed certificate. Rarely hit by end users since the certificate was just built in memory.","solutions":["Re-run the command; if reproducible, check the nebula-cert version matches the nebula-cert library version used at build time","Update nebula-cert to the latest release and rebuild","Report the underlying MarshalPEM error (check the %s detail) upstream if it persists"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Go: ensure cert marshals before writing\nif _, err := c.MarshalPEM(); err != nil {\n    return fmt.Errorf(\"pre-flight marshal failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := runSign(); err != nil {\n    if strings.Contains(err.Error(), \"error while marshalling certificate\") {\n        log.Printf(\"cert marshal failed: %v\", err)\n    }\n}","preventionTips":["Keep nebula-cert binary and cert library versions in sync","Test signing with your CA/key pair before rolling out"],"tags":["go","cli","certificate","pem"],"backgroundTag":"pem-marshal-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}