{"record":{"id":"c427417e85d0b5b4","repo":"slackhq/nebula","slug":"refusing-to-overwrite-existing-cert-s","errorCode":null,"errorMessage":"refusing to overwrite existing cert: %s","messagePattern":"refusing to overwrite existing cert: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":301,"sourceCode":"\t\tpub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing in-pub: %s\", err)\n\t\t}\n\t\tif pubCurve != curve {\n\t\t\treturn fmt.Errorf(\"curve of in-pub does not match ca\")\n\t\t}\n\t} else if isP11 {\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tpub, rawPriv = newKeypair(curve)\n\t}\n\n\tif !isStdio(*sf.outCertPath) {\n\t\tif _, err := os.Stat(*sf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing cert: %s\", *sf.outCertPath)\n\t\t}\n\t}\n\n\tvar crts []cert.Certificate\n\n\tnotBefore := time.Now()\n\tnotAfter := notBefore.Add(*sf.duration)\n\n\tswitch version {\n\tcase cert.Version1:\n\t\t// Make sure we have only one ipv4 address\n\t\tif len(v4Networks) != 1 {\n\t\t\treturn newHelpErrorf(\"invalid -networks definition: v1 certificates can only have a single ipv4 address\")\n\t\t}\n\n\t\tif len(v6Networks) > 0 {\n\t\t\treturn newHelpErrorf(\"invalid -networks definition: v1 certificates can only contain ipv4 addresses\")\n\t\t}","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L283-L319","documentation":"nebula-cert sign refuses to clobber an existing output certificate file. Before writing, it stats -out-cert (unless output is stdio); if the file exists (os.Stat succeeds) it returns this error instead of overwriting. This protects signed certs from accidental destruction.","triggerScenarios":"Running `nebula-cert sign -out-cert host.crt ...` when host.crt already exists on disk and output is not stdio.","commonSituations":"Re-running a provisioning script that already issued the cert; reusing a template command without cleaning the output dir; a previous partial run left the file in place.","solutions":["Delete or rename the existing file (or point -out-cert at a new path) and rerun","If intentional overwrite is desired, remove the file first: `rm host.crt` before signing","Use stdio output (e.g. -out-cert /dev/stdout style stdio handling) if you stream output instead of writing to a path"],"exampleFix":"// before (script re-run fails)\nnebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-cert host.crt -out-key host.key\n// after\nrm -f host.crt host.key\nnebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-cert host.crt -out-key host.key","handlingStrategy":"validation","validationCode":"# shell: fail early if the cert output already exists\nif [ -e \"$OUT_CERT\" ] && [ \"$(readlink -f \"$OUT_CERT\")\" != /dev/stdout ]; then\n  echo \"refusing: $OUT_CERT exists\"; exit 1\nfi\nnebula-cert sign -ca ca.pem -out-cert \"$OUT_CERT\" -out-key \"$OUT_KEY\" ...","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    if strings.Contains(err.Error(), \"refusing to overwrite existing cert\") {\n        // choose a new out-cert path or archive/remove the old file\n    }\n    return err\n}","preventionTips":["Generate unique output paths per host/serial in automation (e.g. include hostname+date)","Clean or archive old outputs before re-running provisioning scripts","Treat this error as a signal that a cert for this identity was already issued"],"tags":["filesystem","overwrite-protection","pki","nebula"],"backgroundTag":"file-already-exists","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}