{"record":{"id":"fe1362ca5c3ae289","repo":"slackhq/nebula","slug":"errnocredential-fe1362","errorCode":"ErrNoCredential","errorMessage":"%w: %v","messagePattern":"%w: %v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"handshake/machine.go","lineNumber":409,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%w: %w\", ErrIndexAllocation, err)\n\t\t\t}\n\t\t\tm.result.LocalIndex = index\n\t\t\tm.indexAllocated = true\n\t\t}\n\n\t\tif m.result.Initiator {\n\t\t\tp.InitiatorIndex = m.result.LocalIndex\n\t\t} else {\n\t\t\tp.ResponderIndex = m.result.LocalIndex\n\t\t\tp.InitiatorIndex = m.result.RemoteIndex\n\t\t}\n\t\tp.Time = uint64(time.Now().UnixNano())\n\t}\n\tif flags.expectsCert {\n\t\tcred := m.getCred(m.myVersion)\n\t\tif cred == nil {\n\t\t\treturn nil, fmt.Errorf(\"%w: %v\", ErrNoCredential, m.myVersion)\n\t\t}\n\t\tp.Cert = cred.Bytes\n\t\tp.CertVersion = uint32(cred.Cert.Version())\n\t\tm.result.MyCert = cred.Cert\n\t}\n\n\treturn MarshalPayload(nil, p), nil\n}\n\nfunc (m *Machine) buildResponse(out []byte) ([]byte, *noise.CipherState, *noise.CipherState, error) {\n\tflags := m.myMsgFlags()\n\thsBytes, err := m.marshalOutgoing(flags)\n\tif err != nil {\n\t\treturn nil, nil, nil, err\n\t}\n\n\t// Extend out by header.Len to make room for the header. slices.Grow is a\n\t// no-op when the cap is already sufficient (the zero-copy case where the","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/handshake/machine.go#L391-L427","documentation":"ErrNoCredential is returned during outgoing handshake marshaling when the node is asked to include its certificate (flags.expectsCert) but no certificate credential is available for the local certificate version m.myVersion. getCred(myVersion) returned nil, meaning the local cert store has no usable certificate for that version.","triggerScenarios":"Calling handshake Initiate/buildResponse when expectsCert is set but the local host has no certificate loaded for the current myVersion (e.g. cert v1 vs v2 mismatch between loaded credentials and machine version).","commonSituations":"Starting nebula with a v2 certificate while the handshake machine is pinned to v1 (or vice versa); cert failed to load/parse at startup; cert was removed by a reload; mixing node versions in a rolling upgrade.","solutions":["Load a certificate matching the machine's myVersion before initiating handshakes (check cert build/version)","Re-issue or convert the host certificate to the expected version format","Verify config 'pki' paths point to a valid cert/key pair and that startup loading succeeded","Upgrade/downgrade the nebula binary so myVersion matches the certificate version"],"exampleFix":"// before: machine built with myVersion = cert.Version2 but only a v1 cert loaded\n// after: ensure the loaded credential version matches\ncred := m.getCred(m.myVersion)\nif cred == nil {\n    // re-load or re-sign the host cert for the required version\n    return nil, fmt.Errorf(\"no %v credential loaded; update pki cert\", m.myVersion)\n}","handlingStrategy":"validation","validationCode":"cred := m.getCred(m.myVersion)\nif cred == nil {\n    return errors.New(\"no local certificate loaded for handshake version; fix pki config before initiating\")\n}","typeGuard":"func hasCredential(m *Machine) bool {\n    return m.getCred(m.myVersion) != nil\n}","tryCatchPattern":null,"preventionTips":["Verify cert loads at startup and log the loaded cert version","Keep pki.cert/pki.key paths correct in config","Align node binary version with certificate version before rolling upgrades"],"tags":["handshake","certificate","configuration"],"backgroundTag":"missing-certificate-credential","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}