slackhq/nebula · error

curve of in-pub does not match ca

Error message

curve of in-pub does not match ca

What it means

nebula-cert sign verifies that the public key supplied via -in-pub was generated on the same elliptic curve as the CA that will sign the new certificate. cert.UnmarshalPublicKeyFromPEM reports the curve embedded in the PEM; when pubCurve != curve (the curve derived from the CA key) the command aborts so the signed cert is not issued with a mismatched key/CA pair. This is a deliberate fail-fast: a cert whose key curve differs from the CA cannot be verified by nebula.

Source

Thrown at cmd/nebula-cert/sign.go:288

	}

	if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
		return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
	}

	if *sf.inPubPath != "" {
		var pubCurve cert.Curve
		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
		if err != nil {
			return fmt.Errorf("error while reading in-pub: %s", err)
		}

		pub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)
		if err != nil {
			return fmt.Errorf("error while parsing in-pub: %s", err)
		}
		if pubCurve != curve {
			return fmt.Errorf("curve of in-pub does not match ca")
		}
	} else if isP11 {
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key with PKCS#11: %w", err)
		}
	} else {
		pub, rawPriv = newKeypair(curve)
	}

	if !isStdio(*sf.outCertPath) {
		if _, err := os.Stat(*sf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
		}
	}

	var crts []cert.Certificate

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the CA's curve (`nebula-cert print -path ca.pem`) and regenerate the public key with the matching -curve flag (`nebula-cert keygen -curve <same-as-ca>`), then rerun sign
2. If you meant to use a different CA, sign against a CA whose curve matches the in-pub key
3. Verify you are pointing -in-pub at the right file and not a key/cert from another environment

Example fix

// before
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -in-pub pub.pem  # pub is Curve25519, CA is P-256
// after
nebula-cert keygen -curve P256 -out-key host.key -out-pub pub.pem
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -in-pub pub.pem

// shell: verify curve match before signing
ca_curve=$(nebula-cert print -path ca.pem | grep -i curve)
pub_curve=$(openssl pkey -pubin -in pub.pem -text -noout | grep -E 'ASN1 OID|NIST CURVE')
# generate the key with the CA's curve so they always match
nebula-cert keygen -curve P256 -out-pub pub.pem -out-key host.key

When it happens

Trigger: Running `nebula-cert sign -in-pub pub.pem ...` where the PEM in -in-pub contains a public key on a different curve than the CA key (e.g. CA is P-256 but the public key is Curve25519, or vice versa).

Common situations: Mixing keys across CAs; regenerating a keypair with a different -curve flag than the CA used; copying a pub file from another nebula deployment; scripts that default to one curve while the CA was created with another.

Related errors

• error while signing: %w
• no certificate state
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided
• no certificates found in pki.cert

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/93dd57468f3c3a62. Report an issue: GitHub.