slackhq/nebula · error

cannot open encrypted ca-key without passphrase

Error message

cannot open encrypted ca-key without passphrase

What it means

Terminal-state error in signCert: the CA key PEM is encrypted, no NEBULA_CA_PASSPHRASE env var was set, and five interactive passphrase prompts yielded nothing (or input is not a TTY loop ended). The encrypted key cannot be opened, so signing aborts.

Source

Thrown at cmd/nebula-cert/sign.go:164

			passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
			if len(passphrase) == 0 {
				// ask for a passphrase until we get one
				for i := 0; i < 5; i++ {
					errOut.Write([]byte("Enter passphrase: "))
					passphrase, err = pr.ReadPassword()

					if errors.Is(err, ErrNoTerminal) {
						return fmt.Errorf("ca-key is encrypted and must be decrypted interactively")
					} else if err != nil {
						return fmt.Errorf("error reading password: %s", err)
					}

					if len(passphrase) > 0 {
						break
					}
				}
				if len(passphrase) == 0 {
					return fmt.Errorf("cannot open encrypted ca-key without passphrase")
				}
			}
			curve, caKey, _, err = cert.DecryptAndUnmarshalSigningPrivateKey(passphrase, rawCAKey)
			if err != nil {
				return fmt.Errorf("error while parsing encrypted ca-key: %s", err)
			}
		} else if err != nil {
			return fmt.Errorf("error while parsing ca-key: %s", err)
		}
	}

	rawCACert, err := readInput("ca-crt", *sf.caCertPath, &claims)
	if err != nil {
		return fmt.Errorf("error while reading ca-crt: %s", err)
	}

	caCert, _, err := cert.UnmarshalCertificateFromPEM(rawCACert)
	if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Set NEBULA_CA_PASSPHRASE to the correct passphrase
2. Run in a terminal and enter the passphrase when prompted
3. Re-generate an unencrypted CA key if encryption is not required

When it happens

Trigger: Thrown at cmd/nebula-cert/sign.go:164 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/0e68efb7b2c530fa. Report an issue: GitHub.