slackhq/nebula · error

certificate contained an unsafe network assignment outside t

Error message

certificate contained an unsafe network assignment outside the limitations of the signing ca: %s

What it means

If the signing CA restricts UnsafeNetworks (subnet routes it may advertise), each unsafe network prefix on the signed certificate must be contained within one of the CA's prefixes. This error names the cert's unsafe-network prefix that the CA is not permitted to issue.

Source

Thrown at cert/ca_pool.go:339

				return fmt.Errorf("certificate contained a network assignment outside the limitations of the signing ca: %s", certNetwork.String())
			}
		}
	}

	// If the signer has a limited set of subnet ranges to issue from make sure the cert only contains a subset
	signingUnsafeNetworks := signer.UnsafeNetworks()
	if len(signingUnsafeNetworks) > 0 {
		for _, certUnsafeNetwork := range unsafeNetworks {
			found := false
			for _, caNetwork := range signingUnsafeNetworks {
				if caNetwork.Contains(certUnsafeNetwork.Addr()) && caNetwork.Bits() <= certUnsafeNetwork.Bits() {
					found = true
					break
				}
			}

			if !found {
				return fmt.Errorf("certificate contained an unsafe network assignment outside the limitations of the signing ca: %s", certUnsafeNetwork.String())
			}
		}
	}

	return nil
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Remove the unsafe network from the cert, or narrow it to fit inside a CA-permitted prefix
2. Add the subnet to the signing CA's UnsafeNetworks list and re-issue the CA
3. Sign with a CA whose UnsafeNetworks cover the desired routes

Example fix

// before
opts.UnsafeNetworks = []netip.Prefix{netip.MustParsePrefix("192.168.5.0/24")} // not in CA
// after
opts.UnsafeNetworks = []netip.Prefix{netip.MustParsePrefix("192.168.1.0/24")} // covered by CA

for _, n := range sub.UnsafeNetworks() {
    covered := false
    for _, ca := range signer.UnsafeNetworks() {
        if ca.Contains(n.Addr()) && ca.Bits() <= n.Bits() {
            covered = true
            break
        }
    }
    if !covered {
        return fmt.Errorf("unsafe network %s outside CA limits", n)
    }
}

When it happens

Trigger: CheckCAConstraints(signer, sub) where a prefix in sub.UnsafeNetworks() is not covered by signer.UnsafeNetworks(); SignWith requesting an UnsafeNetworks entry outside the CA's limits; verify() after signature validation.

Common situations: Host advertises a routed subnet (e.g. 192.168.1.0/24) that the CA's allowlist doesn't cover; operator adds route advertisement to a host without updating the CA's UnsafeNetworks; prefix/bits misconfiguration where cert prefix is broader than any CA prefix.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• certificate expires after signing certificate
• certificate is valid before the signing certificate
• certificate contained a group not present on the signing ca:
• certificate contained a network assignment outside the limit
• unable to marshal unsafe network: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/3aed5efd670fb5b3. Report an issue: GitHub.