{"record":{"id":"ded4a7140d30bbf1","repo":"slackhq/nebula","slug":"error-while-adding-ca-certificate-to-ca-trust-stor","errorCode":null,"errorMessage":"error while adding CA certificate to CA trust store: %s","messagePattern":"error while adding CA certificate to CA trust store: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":574,"sourceCode":"\t}\n\tdefer caReader.Close()\n\n\tcaPool, err := cert.NewCAPoolFromPEMReader(caReader)\n\tif errors.Is(err, cert.ErrExpired) {\n\t\tvar expired int\n\t\tfor _, crt := range caPool.CAs {\n\t\t\tif crt.Certificate.Expired(time.Now()) {\n\t\t\t\texpired++\n\t\t\t\tl.Warn(\"expired certificate present in CA pool\", \"cert\", crt)\n\t\t\t}\n\t\t}\n\n\t\tif expired >= len(caPool.CAs) {\n\t\t\treturn nil, errors.New(\"no valid CA certificates present\")\n\t\t}\n\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"error while adding CA certificate to CA trust store: %s\", err)\n\t}\n\n\tbl := c.GetStringSlice(\"pki.blocklist\", []string{})\n\tif len(bl) > 0 {\n\t\tfor _, fp := range bl {\n\t\t\tcaPool.BlocklistFingerprint(fp)\n\t\t}\n\n\t\tl.Info(\"Blocklisted certificates\", \"fingerprintCount\", len(bl))\n\t}\n\n\treturn caPool, nil\n}\n","sourceCodeStart":556,"sourceCodeEnd":588,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L556-L588","documentation":"When cert.NewCAPoolFromPEMReader returns an error other than the tolerated ErrExpired, loadCAPoolFromConfig wraps it with this message. It means the pki.ca PEM stream contained data that could not be added to the trust store — malformed PEM blocks or unparsable certificates.","triggerScenarios":"reloadCAPool reads a pki.ca whose PEM contains invalid base64, non-certificate blocks, a cert format the parser rejects, or trailing garbage that fails decoding.","commonSituations":"CA file manually concatenated with other PEM material (keys, intermediate chains in wrong format); copy/paste corruption of inline PEM; CA generated by an incompatible tool/version.","solutions":["Regenerate or re-export ca.crt with 'nebula-cert ca' and ensure it contains only valid Nebula CA certificate PEM blocks","Remove non-certificate PEM blocks (private keys, unrelated certs) from the file","Validate the file with 'nebula-cert print -path ca.crt'","If expired CAs were intended to be skipped, rely on the built-in expired-skipping rather than fixing via this path — this error is for unparsable data, not expiry"],"exampleFix":"// before\npki.ca contains: host key block + CA cert block concatenated\n// after\npki.ca contains only: -----BEGIN NEBULA CERTIFICATE----- ... (CA cert)","handlingStrategy":"validation","validationCode":"f, _ := os.Open(caPath)\ndefer f.Close()\nif _, err := cert.NewCAPoolFromPEMReader(f); err != nil && !errors.Is(err, cert.ErrExpired) {\n    return fmt.Errorf(\"invalid pki.ca: %w\", err)\n}","typeGuard":"func caPEMValid(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    return blk != nil && strings.Contains(blk.Type, \"CERTIFICATE\")\n}","tryCatchPattern":"pool, err := loadCAPoolFromConfig(logger, cfg)\nif err != nil && strings.Contains(err.Error(), \"CA trust store\") {\n    return fmt.Errorf(\"pki.ca contains unparsable data: %w\", err)\n}","preventionTips":["Keep pki.ca containing only Nebula CA certificate PEM blocks","Validate with 'nebula-cert print' before deployment","Never concatenate private keys or foreign PEM into pki.ca","Generate CAs only with nebula-cert to ensure format compatibility"],"tags":["pki","ca","certificate","config"],"backgroundTag":"certificate-parse-error","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}