{"record":{"id":"d7b797ce58cee59d","repo":"slackhq/nebula","slug":"error-while-signing-with-pkcs-11-w-d7b797","errorCode":null,"errorMessage":"error while signing with PKCS#11: %w","messagePattern":"error while signing with PKCS#11: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":347,"sourceCode":"\t\t\tGroups:         groups,\n\t\t\tUnsafeNetworks: v4UnsafeNetworks,\n\t\t\tNotBefore:      notBefore,\n\t\t\tNotAfter:       notAfter,\n\t\t\tPublicKey:      pub,\n\t\t\tIsCA:           false,\n\t\t\tCurve:          curve,\n\t\t}\n\n\t\tvar nc cert.Certificate\n\t\tif p11Client == nil {\n\t\t\tnc, err = t.Sign(caCert, curve, caKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing: %w\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tnc, err = t.SignWith(caCert, curve, p11Client.SignASN1)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tcrts = append(crts, nc)\n\n\tcase cert.Version2:\n\t\tt := &cert.TBSCertificate{\n\t\t\tVersion:        cert.Version2,\n\t\t\tName:           *sf.name,\n\t\t\tNetworks:       append(v4Networks, v6Networks...),\n\t\t\tGroups:         groups,\n\t\t\tUnsafeNetworks: append(v4UnsafeNetworks, v6UnsafeNetworks...),\n\t\t\tNotBefore:      notBefore,\n\t\t\tNotAfter:       notAfter,\n\t\t\tPublicKey:      pub,\n\t\t\tIsCA:           false,\n\t\t\tCurve:          curve,\n\t\t}","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L329-L365","documentation":"For v1 certificates with PKCS#11 mode, TBSCertificate.SignWith(caCert, curve, p11Client.SignASN1) failed. The HSM-side ASN.1 signature operation returned an error, which is wrapped here. Without the token's signature, the v1 certificate cannot be finalized.","triggerScenarios":"Running `nebula-cert sign -pkcs11 ...` for a Version1 cert when the token's SignASN1 call fails — bad login/session, key not found, mechanism unsupported for the curve, or HSM error.","commonSituations":"Token requires login but none configured; HSM does not support the required ECDSA/EdDSA mechanism; key object locked by policy; transient PKCS#11 library failure.","solutions":["Check the wrapped PKCS#11 error and token logs for the failing mechanism (CKR_ code)","Verify the token session/login and that the key object supports the signing mechanism for the CA curve","Test signing independently (pkcs11-tool --sign) to isolate HSM vs nebula configuration"],"exampleFix":"// before\nnebula-cert sign -pkcs11 -p11-url 'pkcs11:token=nebula;object=nebula' ...  # not logged in\n// after\nnebula-cert sign -pkcs11 -p11-url 'pkcs11:token=nebula;object=nebula;pin-source=/etc/nebula/pin' ...","handlingStrategy":"retry","validationCode":"# shell: preflight HSM signing capability\npkcs11-tool --module $MODULE --token-label nebula --test --login --pin-file /etc/nebula/pin","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    if strings.Contains(err.Error(), \"error while signing with PKCS#11\") {\n        // check CKR code: transient errors (CKR_DEVICE_ERROR, CKR_SESSION_CLOSED) may be retried\n        // login errors need re-authentication, not retry\n    }\n    return err\n}","preventionTips":["Preflight-test signing on the token before batch issuance","Keep sessions alive: sign promptly after client creation; signCert closes the client via defer","Confirm the key object's CKA_SIGN=true and mechanism list supports the curve"],"tags":["pkcs11","hsm","signing-failure","pki","nebula"],"backgroundTag":"hsm-signing-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}