{"record":{"id":"e91b383185813e9f","repo":"slackhq/nebula","slug":"error-while-generating-qr-code-s-e91b38","errorCode":null,"errorMessage":"error while generating qr code: %s","messagePattern":"error while generating qr code: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":416,"sourceCode":"\n\tvar b []byte\n\tfor _, c := range crts {\n\t\tsb, err := c.MarshalPEM()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while marshalling certificate: %s\", err)\n\t\t}\n\t\tb = append(b, sb...)\n\t}\n\n\terr = writeOutput(*sf.outCertPath, b, 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-crt: %s\", err)\n\t}\n\n\tif *sf.outQRPath != \"\" {\n\t\tb, err = qrcode.Encode(string(b), qrcode.Medium, -5)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while generating qr code: %s\", err)\n\t\t}\n\n\t\terr = writeOutput(*sf.outQRPath, b, 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-qr: %s\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc newKeypair(curve cert.Curve) ([]byte, []byte) {\n\tswitch curve {\n\tcase cert.Curve_CURVE25519:\n\t\treturn x25519Keypair()\n\tcase cert.Curve_P256:\n\t\treturn p256Keypair()\n\tdefault:","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L398-L434","documentation":"When -out-qr is set, signCert encodes the PEM certificate text into a QR code PNG using qrcode.Encode at medium error-correction. If the QR encoder fails, the error is wrapped with this message and signing aborts after the certificate was already written.","triggerScenarios":"qrcode.Encode(string(b), qrcode.Medium, -5) returns an error — practically, the payload (certificate PEM) exceeds QR code capacity or the encoder cannot produce a code for the input.","commonSituations":"Very large certificates (long names, many subnets/groups) producing PEM text too large for a single QR code; misconfigured certificate fields inflating size.","solutions":["Reduce certificate size: shorten -name, trim -groups and -subnets entries","Drop the -out-qr flag and transfer the .crt file directly instead of via QR","Update the qr dependency (skip-2/go-qrcode) via go get -u and rebuild"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Rough pre-check: QR capacity is ~2953 bytes at byte mode / low EC level\nif len(pemBytes) > 2900 {\n    return errors.New(\"certificate too large for QR encoding; skip -out-qr\")\n}","typeGuard":null,"tryCatchPattern":"if err := cmd.Run(); err != nil {\n    if strings.Contains(err.Error(), \"error while generating qr code\") {\n        log.Printf(\"cert too large for QR: %v\", err)\n    }\n}","preventionTips":["Keep certificate names/groups/subnets small if using QR distribution","Only pass -out-qr when you actually need QR delivery","Distribute .crt files directly on larger certs"],"tags":["go","cli","qrcode","certificate"],"backgroundTag":"qr-encode-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}