{"record":{"id":"e4e30574f4005e88","repo":"slackhq/nebula","slug":"refusing-to-overwrite-existing-key-s","errorCode":null,"errorMessage":"refusing to overwrite existing key: %s","messagePattern":"refusing to overwrite existing key: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":389,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"error while signing: %w\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tnc, err = t.SignWith(caCert, curve, p11Client.SignASN1)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tcrts = append(crts, nc)\n\tdefault:\n\t\t// this should be unreachable\n\t\treturn fmt.Errorf(\"invalid version: %d\", version)\n\t}\n\n\tif !isP11 && *sf.inPubPath == \"\" {\n\t\tif !isStdio(*sf.outKeyPath) {\n\t\t\tif _, err := os.Stat(*sf.outKeyPath); err == nil {\n\t\t\t\treturn fmt.Errorf(\"refusing to overwrite existing key: %s\", *sf.outKeyPath)\n\t\t\t}\n\t\t}\n\n\t\terr = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tvar b []byte\n\tfor _, c := range crts {\n\t\tsb, err := c.MarshalPEM()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t\t}\n\t\tb = append(b, sb...)\n\t}\n","sourceCodeStart":371,"sourceCodeEnd":407,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L371-L407","documentation":"Like the cert overwrite check, sign refuses to replace an existing private key file. When a fresh key was generated (no -in-pub, no PKCS#11) and -out-key exists on disk (os.Stat succeeds, non-stdio), the command returns this error rather than silently destroying a private key.","triggerScenarios":"Running `nebula-cert sign -out-key host.key ...` (with a generated key, i.e. no -in-pub and no -pkcs11) when host.key already exists.","commonSituations":"Re-running provisioning scripts; leftover key from a prior run; reusing a host name in automation without cleanup; accidentally pointing -out-key at an existing key you must not lose.","solutions":["Move or delete the existing key file, or choose a new -out-key path, then rerun","If the key must be preserved, back it up before regenerating; note deleting it invalidates any cert issued for it","Reuse the existing key via -in-pub instead of generating a new one"],"exampleFix":"// before\nnebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key host.key -out-cert host.crt  # fails: host.key exists\n// after\nmv host.key host.key.bak\nnebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key host.key -out-cert host.crt","handlingStrategy":"validation","validationCode":"# shell: fail early if the key output already exists\nif [ -e \"$OUT_KEY\" ] && [ \"$(readlink -f \"$OUT_KEY\")\" != /dev/stdout ]; then\n  echo \"refusing: $OUT_KEY exists\"; exit 1\nfi\nnebula-cert sign -ca ca.pem -out-key \"$OUT_KEY\" -out-cert \"$OUT_CERT\" ...","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    if strings.Contains(err.Error(), \"refusing to overwrite existing key\") {\n        // archive or remove the old key, or switch to -in-pub to reuse it\n    }\n    return err\n}","preventionTips":["Include unique identity (hostname/serial) in key paths in automation","Back up existing keys before any re-issuance run","Remember both -out-key and -out-cert must not exist; check both before signing"],"tags":["filesystem","private-key","overwrite-protection","nebula"],"backgroundTag":"file-already-exists","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}