{"record":{"id":"ce2a8624d65f8e43","repo":"slackhq/nebula","slug":"error-while-creating-pkcs-11-client-w-ce2a86","errorCode":null,"errorMessage":"error while creating PKCS#11 client: %w","messagePattern":"error while creating PKCS#11 client: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":265,"sourceCode":"\n\tvar groups []string\n\tif *sf.groups != \"\" {\n\t\tfor _, rg := range strings.Split(*sf.groups, \",\") {\n\t\t\tg := strings.TrimSpace(rg)\n\t\t\tif g != \"\" {\n\t\t\t\tgroups = append(groups, g)\n\t\t\t}\n\t\t}\n\t}\n\n\tvar pub, rawPriv []byte\n\tvar p11Client *pkclient.PKClient\n\n\tif isP11 {\n\t\tcurve = cert.Curve_P256\n\t\tp11Client, err = pkclient.FromUrl(*sf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t}\n\n\tif fips140.Enforced() && curve == cert.Curve_CURVE25519 {\n\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t}\n\n\tif *sf.inPubPath != \"\" {\n\t\tvar pubCurve cert.Curve\n\t\trawPub, err := readInput(\"in-pub\", *sf.inPubPath, &claims)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while reading in-pub: %s\", err)\n\t\t}\n\n\t\tpub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L247-L283","documentation":"Wrapping error in signCert when -p11url is set: pkclient.FromUrl failed to construct a PKCS#11 HSM client. The URL could not be parsed, the module could not be loaded, or the token/slot was not found; the underlying error is preserved with %w.","triggerScenarios":"Thrown at cmd/nebula-cert/sign.go:265 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the pkcs11 URI syntax (module path, slot, token, PIN)","Verify the HSM/PKCS#11 module is installed and the token is present","Confirm the process can access the PKCS#11 library file"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}