{"record":{"id":"c1b8e6723eff2853","repo":"slackhq/nebula","slug":"errbadformat","errorCode":"ErrBadFormat","errorMessage":"bad wire format","messagePattern":"bad wire format","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":9,"sourceCode":"package cert\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n)\n\nvar (\n\tErrBadFormat                  = errors.New(\"bad wire format\")\n\tErrRootExpired                = errors.New(\"root certificate is expired\")\n\tErrExpired                    = errors.New(\"certificate is expired\")\n\tErrNotCA                      = errors.New(\"certificate is not a CA\")\n\tErrNotSelfSigned              = errors.New(\"certificate is not self-signed\")\n\tErrBlockListed                = errors.New(\"certificate is in the block list\")\n\tErrFingerprintMismatch        = errors.New(\"certificate fingerprint did not match\")\n\tErrSignatureMismatch          = errors.New(\"certificate signature did not match\")\n\tErrInvalidPublicKey           = errors.New(\"invalid public key\")\n\tErrInvalidPrivateKey          = errors.New(\"invalid private key\")\n\tErrPublicPrivateCurveMismatch = errors.New(\"public key does not match private key curve\")\n\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L1-L27","documentation":"ErrBadFormat signals that an input byte slice is not a well-formed Nebula v2 certificate wire format. unmarshalCertificateV2 rejects buffers that are empty, exceed MaxCertificateSize, or whose ASN.1 DER envelope cannot be parsed as the expected SEQUENCE structure.","triggerScenarios":"Calling unmarshalCertificateV2 / unmarshalDetails with a zero-length byte slice, a byte slice larger than MaxCertificateSize, or bytes whose DER envelope is not an ASN.1 SEQUENCE or has an empty body (cert/cert_v2.go:573-579).","commonSituations":"Loading a v1 certificate or a PEM-encoded file without stripping the PEM armor before passing raw bytes; truncated network transmission; pointing a config field at a non-certificate file; receiving garbage on the handshake channel.","solutions":["Verify the bytes are the raw DER payload of a v2 certificate, not the PEM text — decode the PEM block first (pem.Decode) and pass block.Bytes.","Check len(b) > 0 and len(b) <= MaxCertificateSize before calling.","Confirm the peer / file is actually serving a Nebula v2 certificate; v1 certs must be decoded with the v1 unmarshal path.","Inspect the source of the bytes for truncation or corruption (log the length and first bytes)."],"exampleFix":"// before\nraw, _ := os.ReadFile(\"ca.crt\")\nc, err := cert.UnmarshalCertificateV2(raw)\n\n// after\nblock, _ := pem.Decode(raw)\nc, err := cert.UnmarshalCertificateV2(block.Bytes)\nif err != nil { ... }","handlingStrategy":"validation","validationCode":"if len(b) == 0 || len(b) > cert.MaxCertificateSize {\n    return fmt.Errorf(\"cert payload: got %d bytes\", len(b))\n}","typeGuard":"func isPlausibleCertBytes(b []byte) bool {\n    return len(b) > 0 && len(b) <= cert.MaxCertificateSize && b[0] == 0x30 // DER SEQUENCE\n}","tryCatchPattern":"c, err := cert.UnmarshalCertificateV2(b)\nif errors.Is(err, cert.ErrBadFormat) {\n    return fmt.Errorf(\"not a v2 nebula certificate (%d bytes); check PEM decoding\", len(b))\n}","preventionTips":["Always pem.Decode before unmarshaling cert files.","Check byte length against cert.MaxCertificateSize first.","Confirm certificate version (v1 vs v2) and use the matching unmarshal API."],"tags":["parsing","asn1","certificate"],"backgroundTag":"invalid-wire-format","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}