{"record":{"id":"ea4dcd01a5da2d0c","repo":"slackhq/nebula","slug":"errnotselfsigned","errorCode":"ErrNotSelfSigned","errorMessage":"certificate is not self-signed","messagePattern":"certificate is not self-signed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":13,"sourceCode":"package cert\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n)\n\nvar (\n\tErrBadFormat                  = errors.New(\"bad wire format\")\n\tErrRootExpired                = errors.New(\"root certificate is expired\")\n\tErrExpired                    = errors.New(\"certificate is expired\")\n\tErrNotCA                      = errors.New(\"certificate is not a CA\")\n\tErrNotSelfSigned              = errors.New(\"certificate is not self-signed\")\n\tErrBlockListed                = errors.New(\"certificate is in the block list\")\n\tErrFingerprintMismatch        = errors.New(\"certificate fingerprint did not match\")\n\tErrSignatureMismatch          = errors.New(\"certificate signature did not match\")\n\tErrInvalidPublicKey           = errors.New(\"invalid public key\")\n\tErrInvalidPrivateKey          = errors.New(\"invalid private key\")\n\tErrPublicPrivateCurveMismatch = errors.New(\"public key does not match private key curve\")\n\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")\n\tErrInvalidPEMCertificateBanner       = errors.New(\"bytes did not contain a proper certificate banner\")\n\tErrInvalidPEMX25519PublicKeyBanner   = errors.New(\"bytes did not contain a proper X25519 public key banner\")\n\tErrInvalidPEMX25519PrivateKeyBanner  = errors.New(\"bytes did not contain a proper X25519 private key banner\")\n\tErrInvalidPEMEd25519PublicKeyBanner  = errors.New(\"bytes did not contain a proper Ed25519 public key banner\")","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L1-L31","documentation":"ErrNotSelfSigned is returned by CAPool.AddCA when the candidate CA certificate's signature cannot be verified with its own public key (CheckSignature(c.PublicKey()) fails). A trust anchor must be self-signed.","triggerScenarios":"pool.AddCA(c) is called and c.CheckSignature(c.PublicKey()) returns false — i.e., the cert was signed by another key rather than its own, or the signature bytes/cipher are corrupt.","commonSituations":"Adding an intermediate or leaf certificate (signed by the root) directly into the pool instead of the self-signed root; corrupted cert bytes; certs hand-mangled during distribution.","solutions":["Add the root self-signed CA certificate to the pool, not an intermediate or leaf.","Re-verify the certificate file integrity (checksums, clean re-download).","If using intermediates, chain them properly and add only the self-signed root to CAPool.","Handle the wrapped format with errors.Is(err, cert.ErrNotSelfSigned) since AddCA wraps it with the cert name."],"exampleFix":"// before\npool.AddCA(intermediateCert) // not self-signed\n\n// after\npool.AddCA(rootCACert) // self-signed trust anchor","handlingStrategy":"validation","validationCode":"if !c.CheckSignature(c.PublicKey()) {\n    return fmt.Errorf(\"%s is not self-signed; add the root CA instead\", c.Name())\n}","typeGuard":"func isSelfSigned(c cert.Certificate) bool {\n    return c.CheckSignature(c.PublicKey())\n}","tryCatchPattern":"err := pool.AddCA(c)\nif errors.Is(err, cert.ErrNotSelfSigned) {\n    return fmt.Errorf(\"%s is signed by another CA; load the self-signed root\", c.Name())\n}","preventionTips":["Only load root trust anchors into CAPool.","Verify self-signedness of any cert you add to a pool.","Checksum cert files after distribution to catch corruption."],"tags":["certificate","signature","ca-pool"],"backgroundTag":"certificate-not-self-signed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}