slackhq/nebula · critical

ErrBlockListed

ErrBlockListed

Error message

certificate is in the block list

What it means

ErrBlockListed means the certificate's fingerprint (or an alternate fingerprint form, e.g. P256 high-s/low-s variant) is present in the pool's block list. Verification refuses the certificate even if it would otherwise chain to a trusted CA.

Source

Thrown at cert/errors.go:14

package cert

import (
	"errors"
	"fmt"
)

var (
	ErrBadFormat                  = errors.New("bad wire format")
	ErrRootExpired                = errors.New("root certificate is expired")
	ErrExpired                    = errors.New("certificate is expired")
	ErrNotCA                      = errors.New("certificate is not a CA")
	ErrNotSelfSigned              = errors.New("certificate is not self-signed")
	ErrBlockListed                = errors.New("certificate is in the block list")
	ErrFingerprintMismatch        = errors.New("certificate fingerprint did not match")
	ErrSignatureMismatch          = errors.New("certificate signature did not match")
	ErrInvalidPublicKey           = errors.New("invalid public key")
	ErrInvalidPrivateKey          = errors.New("invalid private key")
	ErrPublicPrivateCurveMismatch = errors.New("public key does not match private key curve")
	ErrPublicPrivateKeyMismatch   = errors.New("public key and private key are not a pair")
	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
	ErrUnknownVersion             = errors.New("certificate version unrecognized")
	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
	ErrCurveMismatch              = errors.New("certificate curve does not match CA")

	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")
	ErrInvalidPEMX25519PublicKeyBanner   = errors.New("bytes did not contain a proper X25519 public key banner")
	ErrInvalidPEMX25519PrivateKeyBanner  = errors.New("bytes did not contain a proper X25519 private key banner")
	ErrInvalidPEMEd25519PublicKeyBanner  = errors.New("bytes did not contain a proper Ed25519 public key banner")
	ErrInvalidPEMEd25519PrivateKeyBanner = errors.New("bytes did not contain a proper Ed25519 private key banner")

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Issue a brand-new certificate/key pair for the node and update its config.
2. Remove the stale entry from the blocklist (ca_pool blocklist data) only if the block was a mistake.
3. Check whether fingerprint normalization (high-s/low-s P256 forms) is causing an unintended match; compare both fingerprint forms.
4. Use errors.Is(err, cert.ErrBlockListed) to distinguish revocation from other verification failures.

Example fix

// before
// node still runs with revoked cert
valid, err := pool.VerifyCertificate(oldCert)

// after
newPair := reissueCertificate(hostName) // new key material
pool.RemoveBlockedFingerprint(fpOf(oldCert)) // if block was erroneous
valid, err := pool.VerifyCertificate(newPair.Cert)

fp := hex.EncodeToString(c.Fingerprint)
if pool.IsBlocklisted(fp) {
    log.Warn("certificate %s is blocklisted — reissue", c.Name())
}

func isBlocked(pool *cert.CAPool, c cert.Certificate) bool {
    return pool.IsBlocklisted(hex.EncodeToString(c.Fingerprint))
}

if _, err := pool.VerifyCertificate(c, fp, ""); errors.Is(err, cert.ErrBlockListed) {
    return fmt.Errorf("cert revoked: issue a new keypair for this host")
}

When it happens

Trigger: verify/VerifyCertificate/VerifyCachedCertificate (cert/ca_pool.go:180, 203) when ncp.IsBlocklisted(fp) or ncp.IsBlocklisted(c.fingerprint2) is true; isInvalidCertificate checks incoming handshake certs against the block list.

Common situations: A previously issued certificate/key pair was compromised and revoked by the operator; stale blocklist entries surviving after cert rotation; a node reusing a revoked cert from an old config.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ErrBadFormat
• ErrRootExpired
• ErrExpired
• ErrNotCA
• ErrNotSelfSigned

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/b08f545be715eb44. Report an issue: GitHub.