slackhq/nebula · error

certificate contained a network assignment outside the limit

Error message

certificate contained a network assignment outside the limitations of the signing ca: %s

What it means

If the signing CA restricts Networks (VPN address ranges it may issue), each network prefix on the signed certificate must be contained within one of the CA's prefixes (same address inside, cert prefix bits >= CA prefix bits). This error names the cert network prefix that falls outside the CA's allowed ranges.

Source

Thrown at cert/ca_pool.go:321

				return fmt.Errorf("certificate contained a group not present on the signing ca: %s", g)
			}
		}
	}

	// If the signer has a limited set of ip ranges to issue from make sure the cert only contains a subset
	signingNetworks := signer.Networks()
	if len(signingNetworks) > 0 {
		for _, certNetwork := range networks {
			found := false
			for _, signingNetwork := range signingNetworks {
				if signingNetwork.Contains(certNetwork.Addr()) && signingNetwork.Bits() <= certNetwork.Bits() {
					found = true
					break
				}
			}

			if !found {
				return fmt.Errorf("certificate contained a network assignment outside the limitations of the signing ca: %s", certNetwork.String())
			}
		}
	}

	// If the signer has a limited set of subnet ranges to issue from make sure the cert only contains a subset
	signingUnsafeNetworks := signer.UnsafeNetworks()
	if len(signingUnsafeNetworks) > 0 {
		for _, certUnsafeNetwork := range unsafeNetworks {
			found := false
			for _, caNetwork := range signingUnsafeNetworks {
				if caNetwork.Contains(certUnsafeNetwork.Addr()) && caNetwork.Bits() <= certUnsafeNetwork.Bits() {
					found = true
					break
				}
			}

			if !found {
				return fmt.Errorf("certificate contained an unsafe network assignment outside the limitations of the signing ca: %s", certUnsafeNetwork.String())

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Assign the host an IP inside one of the CA's allowed network ranges
2. Widen the CA's Networks list (re-issue CA) to include the requested range
3. Request a more specific prefix that fits within a CA prefix

Example fix

// before
opts.Networks = []netip.Prefix{netip.MustParsePrefix("10.1.0.5/24")} // outside CA 10.0.0.0/24
// after
opts.Networks = []netip.Prefix{netip.MustParsePrefix("10.0.0.5/24")} // inside CA range

for _, n := range sub.Networks() {
    covered := false
    for _, ca := range signer.Networks() {
        if ca.Contains(n.Addr()) && ca.Bits() <= n.Bits() {
            covered = true
            break
        }
    }
    if !covered {
        return fmt.Errorf("network %s outside CA limits", n)
    }
}

When it happens

Trigger: CheckCAConstraints(signer, sub) where a prefix in sub.Networks() is not covered by any signer.Networks() prefix; SignWith requesting a Networks assignment outside the CA's limits; verify() after signature validation.

Common situations: Host config requests an IP outside the CA's subnet (e.g. CA issues only 10.0.0.0/24 but cert claims 10.1.0.0/24); cert requests a shorter (larger) prefix than the CA allows; IPv4/IPv6 family mismatch between CA and cert networks.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• certificate expires after signing certificate
• certificate is valid before the signing certificate
• certificate contained a group not present on the signing ca:
• certificate contained an unsafe network assignment outside t
• unable to marshal network: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/862dbe5a6087ffdf. Report an issue: GitHub.