{"record":{"id":"dd8ad258ba376c21","repo":"slackhq/nebula","slug":"error-while-writing-out-crt-s-dd8ad2","errorCode":null,"errorMessage":"error while writing out-crt: %s","messagePattern":"error while writing out-crt: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":410,"sourceCode":"\n\t\terr = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tvar b []byte\n\tfor _, c := range crts {\n\t\tsb, err := c.MarshalPEM()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t\t}\n\t\tb = append(b, sb...)\n\t}\n\n\terr = writeOutput(*sf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *sf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}\n\n\t\terr = writeOutput(*sf.outQRPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-qr: %s\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc newKeypair(curve cert.Curve) ([]byte, []byte) {","sourceCodeStart":392,"sourceCodeEnd":428,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L392-L428","documentation":"After successfully signing and PEM-marshalling the certificate(s), signCert writes the concatenated PEM bytes to the -out-crt path via writeOutput. When writeOutput fails (unwritable path, bad directory, permission denied), the error is wrapped as 'error while writing out-crt'.","triggerScenarios":"writeOutput(*sf.outCertPath, b, 0600, out) returns an error — typically because outCertPath points to a non-existent directory, is not writable, or the underlying writer (stdout) errored.","commonSituations":"Typo in the -out-crt path; parent directory does not exist; read-only filesystem; no write permission; writing to stdout when stdout is a closed pipe.","solutions":["Verify the -out-crt path's parent directory exists and is writable","Run with corrected permissions or a different output location","If writing to stdout ('-'), ensure stdout is connected and writable"],"exampleFix":"// before\n./nebula-cert sign -ca ca.pem -key ca.key -name host -out-crt /nonexistent/host.crt\n// after\nmkdir -p /etc/nebula && ./nebula-cert sign -ca ca.pem -key ca.key -name host -out-crt /etc/nebula/host.crt","handlingStrategy":"validation","validationCode":"import \"os\"\nif dir := filepath.Dir(outPath); !isWritableDir(dir) {\n    return fmt.Errorf(\"cannot write cert to %s\", outPath)\n}\nfunc isWritableDir(d string) bool {\n    fi, err := os.Stat(d)\n    return err == nil && fi.IsDir()\n}","typeGuard":null,"tryCatchPattern":"if err := cmd.Run(); err != nil {\n    if strings.Contains(err.Error(), \"error while writing out-crt\") {\n        log.Printf(\"check -out-crt path: %v\", err)\n    }\n}","preventionTips":["Pre-create the output directory (mkdir -p) before signing","Use absolute paths in scripts","Avoid writing certs to read-only mounts"],"tags":["go","cli","filesystem","file-write"],"backgroundTag":"file-write-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}