{"record":{"id":"d449f0f8caa39a64","repo":"slackhq/nebula","slug":"marshalling-certificate-details-failed-w","errorCode":null,"errorMessage":"marshalling certificate details failed: %w","messagePattern":"marshalling certificate details failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/cert_v2.go","lineNumber":465,"sourceCode":"\t\t\t\t\treturn NewErrInvalidCertificateProperties(\"IPv4 unsafe networks require an IPv4 address assignment: %s\", network)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tslices.SortFunc(c.details.unsafeNetworks, comparePrefix)\n\terr = findDuplicatePrefix(c.details.unsafeNetworks)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc (c *certificateV2) marshalForSigning() ([]byte, error) {\n\td, err := c.details.Marshal()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"marshalling certificate details failed: %w\", err)\n\t}\n\tc.rawDetails = d\n\n\tb := make([]byte, len(c.rawDetails)+1+len(c.publicKey))\n\tcopy(b, c.rawDetails)\n\tb[len(c.rawDetails)] = byte(c.curve)\n\tcopy(b[len(c.rawDetails)+1:], c.publicKey)\n\treturn b, nil\n}\n\nfunc (c *certificateV2) setSignature(b []byte) error {\n\tif len(b) == 0 {\n\t\treturn ErrEmptySignature\n\t}\n\tc.signature = b\n\treturn nil\n}\n","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/cert_v2.go#L447-L483","documentation":"marshalForSigning serializes the certificate's details via details.Marshal() before signing; if that marshalling fails, this wrapped error is returned. Details marshalling can fail on invalid inner data (e.g. network entries or a non-hex issuer), so this error wraps the underlying cause.","triggerScenarios":"Building/signing a certificate whose details contain data that fails Marshal: a network entry whose MarshalBinary errors, or an issuer string that is not valid hex, triggered via certificate creation/signing paths.","commonSituations":"Programmatically constructed certificates with malformed networks or issuer fields, fuzz/testing of the signing path, or corrupt in-memory certificate structs.","solutions":["Inspect the wrapped cause (%w) to find which details field failed.","Validate that d.issuer is a valid hex string before signing.","Ensure network entries (host, mask, etc.) are fully populated and valid before marshalling."],"exampleFix":"// before\nca, _ := cert.NewCertificate(vpnNetworks, opts)\nsign, err := ca.Marshal() // marshalling certificate details failed: failed to decode issuer: ...\n// after\ncertDetails.Issuer = hex.EncodeToString(caCert.Raw()) // issuer must be hex\nsign, err := ca.Marshal()","handlingStrategy":"try-catch","validationCode":"if certDetails.Issuer != \"\" {\n    if _, err := hex.DecodeString(certDetails.Issuer); err != nil {\n        return fmt.Errorf(\"issuer must be hex: %w\", err)\n    }\n}","typeGuard":"func isHex(s string) bool {\n    _, err := hex.DecodeString(s)\n    return err == nil\n}","tryCatchPattern":"raw, err := c.Marshal() // triggers marshalForSigning\nif err != nil && strings.Contains(err.Error(), \"marshalling certificate details failed\") {\n    log.Fatalf(\"certificate details invalid: %v\", err) // err wraps root cause\n}","preventionTips":["Always set Issuer via hex.EncodeToString of the signing cert's raw bytes.","Validate network entries before signing.","Prefer the library's certificate builder functions over manual struct construction."],"tags":["certificate","marshalling","signing"],"backgroundTag":"certificate-marshalling-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}