could not calculate fingerprint for provided CA; error

Error message

could not calculate fingerprint for provided CA; error: %w; %s

What it means

CAPool.AddCA calls c.Fingerprint() to compute the SHA-256 fingerprint used as the pool key for the CA; if that computation returns an error, this message wraps the underlying error along with the certificate name. Fingerprinting should only fail if the certificate's raw data is unavailable or malformed.

Solutions

Re-decode the certificate from a known-good PEM source and retry
Inspect the wrapped error to identify the underlying hashing/raw-data failure
Ensure custom Certificate implementations return valid raw bytes from Fingerprint

Defensive patterns

Strategy: try-catch

Validate before calling

// ensure the certificate decodes with valid raw bytes before AddCA
if fp, err := c.Fingerprint(); err != nil {
    return fmt.Errorf("cannot add CA %s: %w", c.Name(), err)
} else {
    _ = fp
}

Try / catch

if err := pool.AddCA(c); err != nil {
    if strings.Contains(err.Error(), "could not calculate fingerprint") {
        log.Fatalf("CA %s has unusable raw data: %v", c.Name(), err)
    }
    return err
}

Prevention

Re-decode certificates from the original PEM rather than passing hand-built structs
Keep custom Certificate implementations' Fingerprint methods tested
Round-trip parse certificates once at load time and fail fast on errors

When it happens

Trigger: Calling AddCA with a Certificate implementation whose Fingerprint() fails (e.g. corrupted internal state or unreadable raw bytes), propagating the wrapped hash error.

Common situations: Programmatically constructed or deserialized certificates with missing raw bytes, custom Certificate implementations with broken Fingerprint methods, or certs decoded from damaged data.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/1d5628736d62b5b1. Report an issue: GitHub.

Appendix: source

Thrown at cert/ca_pool.go:112

		return pemBytes, err
	}

	return pemBytes, nil
}

// AddCA verifies a Nebula CA certificate and adds it to the pool.
func (ncp *CAPool) AddCA(c Certificate) error {
	if !c.IsCA() {
		return fmt.Errorf("%s: %w", c.Name(), ErrNotCA)
	}

	if !c.CheckSignature(c.PublicKey()) {
		return fmt.Errorf("%s: %w", c.Name(), ErrNotSelfSigned)
	}

	sum, err := c.Fingerprint()
	if err != nil {
		return fmt.Errorf("could not calculate fingerprint for provided CA; error: %w; %s", err, c.Name())
	}

	cc := &CachedCertificate{
		Certificate:    c,
		Fingerprint:    sum,
		InvertedGroups: make(map[string]struct{}),
	}

	for _, g := range c.Groups() {
		cc.InvertedGroups[g] = struct{}{}
	}

	ncp.CAs[sum] = cc

	if c.Expired(time.Now()) {
		return fmt.Errorf("%s: %w", c.Name(), ErrExpired)
	}

View on GitHub (pinned to dd8f660c0a)