{"record":{"id":"e5a77df48cd645a3","repo":"slackhq/nebula","slug":"refusing-to-overwrite-existing-ca-key-s","errorCode":null,"errorMessage":"refusing to overwrite existing CA key: %s","messagePattern":"refusing to overwrite existing CA key: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":315,"sourceCode":"\t\t}\n\t}\n\n\tt := &cert.TBSCertificate{\n\t\tVersion:        version,\n\t\tName:           *cf.name,\n\t\tGroups:         groups,\n\t\tNetworks:       networks,\n\t\tUnsafeNetworks: unsafeNetworks,\n\t\tNotBefore:      time.Now(),\n\t\tNotAfter:       time.Now().Add(*cf.duration),\n\t\tPublicKey:      pub,\n\t\tIsCA:           true,\n\t\tCurve:          curve,\n\t}\n\n\tif !isP11 && !isStdio(*cf.outKeyPath) {\n\t\tif _, err := os.Stat(*cf.outKeyPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA key: %s\", *cf.outKeyPath)\n\t\t}\n\t}\n\n\tif !isStdio(*cf.outCertPath) {\n\t\tif _, err := os.Stat(*cf.outCertPath); err == nil {\n\t\t\treturn fmt.Errorf(\"refusing to overwrite existing CA cert: %s\", *cf.outCertPath)\n\t\t}\n\t}\n\n\tvar c cert.Certificate\n\tvar b []byte\n\n\tif isP11 {\n\t\tc, err = t.SignWith(nil, curve, p11Client.SignASN1)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t}\n\t} else {","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L297-L333","documentation":"Safety guard in `nebula-cert ca`: before writing the new CA private key, os.Stat checks -out-key-path and if the file already exists (and the target is not stdio and PKCS#11 is not in use) the command aborts instead of clobbering an existing CA key. Destroying an old CA key would orphan every cert it signed, so overwrite is refused.","triggerScenarios":"nebula-cert ca with -out-key-path pointing to an existing file; e.g. re-running the same ca command twice, or a previous failed run left a partial key file on disk.","commonSituations":"Idempotent re-runs in CI/automation; leftover key from an earlier aborted run; wrong working directory causing an existing key path to be hit; confusion with -out-key-path defaulting to ca.key in cwd.","solutions":["Move or delete the existing key file only if you truly intend to retire the CA","Choose a new -out-key-path for the new CA","Write to stdout (-out-key-path with '-' / stdio) if you redirect yourself","If the file is a stale partial from a failed run, remove it after confirming it is not a live CA key"],"exampleFix":"// before\nnebula-cert ca -name \"my ca\"   # fails: ca.key exists\n// after\nmv ca.key ca.key.old && nebula-cert ca -name \"my ca\"","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(outKeyPath); err == nil {\n\treturn fmt.Errorf(\"key %s exists; move it or choose another path\", outKeyPath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check -out-key-path existence before invoking ca","Use unique output directories per CA generation in automation","Keep stdio ('-') output in scripts and manage files yourself","Treat existing ca.key as precious — archive, never overwrite"],"tags":["filesystem","safety","cli","overwrite-guard"],"backgroundTag":"refusing-to-overwrite-existing-file","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}