slackhq/nebula · error

ErrInvalidPEMEd25519PublicKeyBanner

ErrInvalidPEMEd25519PublicKeyBanner

Error message

bytes did not contain a proper Ed25519 public key banner

What it means

ErrInvalidPEMEd25519PublicKeyBanner is thrown when PEM bytes expected to contain an Ed25519 public key do not carry the proper Ed25519 PUBLIC KEY banner. The parser matches the PEM block type against the expected key kind and rejects any other banner (certificate, private key, X25519 key).

Source

Thrown at cert/errors.go:31

	ErrNotSelfSigned              = errors.New("certificate is not self-signed")
	ErrBlockListed                = errors.New("certificate is in the block list")
	ErrFingerprintMismatch        = errors.New("certificate fingerprint did not match")
	ErrSignatureMismatch          = errors.New("certificate signature did not match")
	ErrInvalidPublicKey           = errors.New("invalid public key")
	ErrInvalidPrivateKey          = errors.New("invalid private key")
	ErrPublicPrivateCurveMismatch = errors.New("public key does not match private key curve")
	ErrPublicPrivateKeyMismatch   = errors.New("public key and private key are not a pair")
	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
	ErrUnknownVersion             = errors.New("certificate version unrecognized")
	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
	ErrCurveMismatch              = errors.New("certificate curve does not match CA")

	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")
	ErrInvalidPEMX25519PublicKeyBanner   = errors.New("bytes did not contain a proper X25519 public key banner")
	ErrInvalidPEMX25519PrivateKeyBanner  = errors.New("bytes did not contain a proper X25519 private key banner")
	ErrInvalidPEMEd25519PublicKeyBanner  = errors.New("bytes did not contain a proper Ed25519 public key banner")
	ErrInvalidPEMEd25519PrivateKeyBanner = errors.New("bytes did not contain a proper Ed25519 private key banner")

	ErrNoPeerStaticKey = errors.New("no peer static key was present")
	ErrNoPayload       = errors.New("provided payload was empty")

	ErrMissingDetails  = errors.New("certificate did not contain details")
	ErrEmptySignature  = errors.New("empty signature")
	ErrEmptyRawDetails = errors.New("empty rawDetails not allowed")
)

type ErrInvalidCertificateProperties struct {
	str string
}

func NewErrInvalidCertificateProperties(format string, a ...any) error {
	return &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Confirm the PEM file's BEGIN line declares an Ed25519 public key
2. Point the config at the peer's Ed25519 public key file rather than the private key or certificate
3. Re-export or regenerate the peer public key for the Ed25519 curve if the wrong key type was distributed

Example fix

// before
pub, _ := os.ReadFile("ca.crt") // certificate, not a key
// after
pub, _ := os.ReadFile("peer_ed25519.pub") // proper Ed25519 PUBLIC KEY banner

block, _ := pem.Decode(pubBytes)
if block == nil || !strings.Contains(block.Type, "ED25519 PUBLIC KEY") {
    return fmt.Errorf("not an Ed25519 public key PEM")
}

func isEd25519PublicKeyPEM(b []byte) bool {
    blk, _ := pem.Decode(b)
    return blk != nil && strings.Contains(blk.Type, "ED25519 PUBLIC KEY")
}

pub, err := loadEd25519PubKey(pubBytes)
if errors.Is(err, cert.ErrInvalidPEMEd25519PublicKeyBanner) {
    // wrong banner: check file paths and key type
}

When it happens

Trigger: Feeding an Ed25519 public key decoder bytes whose PEM block type is not the expected Ed25519 public key banner — e.g. a private key, an X25519 public key, or a certificate.

Common situations: Swapped public/private key files in config; publishing a peer's static key where a certificate was intended; keys rotated to a different curve; copy-paste truncating the PEM header.

Related errors

• ErrInvalidPEMEd25519PrivateKeyBanner
• ErrInvalidPEMX25519PrivateKeyBanner
• key was not %d bytes, is invalid Ed25519 private key
• ErrTruncatedPEMBlock
• Empty configuration

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/024b854b023f9410. Report an issue: GitHub.