slackhq/nebula · error

ErrMissingDetails

ErrMissingDetails

Error message

certificate did not contain details

What it means

ErrMissingDetails is returned by Fingerprint (and exercised in certificateV2 JSON marshalling tests) when the certificate's rawDetails field is empty. A certificate without its details blob has nothing to fingerprint or serialize, so the accessor fails rather than returning a meaningless empty value.

Source

Thrown at cert/errors.go:37

	ErrPublicPrivateCurveMismatch = errors.New("public key does not match private key curve")
	ErrPublicPrivateKeyMismatch   = errors.New("public key and private key are not a pair")
	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
	ErrUnknownVersion             = errors.New("certificate version unrecognized")
	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
	ErrCurveMismatch              = errors.New("certificate curve does not match CA")

	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")
	ErrInvalidPEMX25519PublicKeyBanner   = errors.New("bytes did not contain a proper X25519 public key banner")
	ErrInvalidPEMX25519PrivateKeyBanner  = errors.New("bytes did not contain a proper X25519 private key banner")
	ErrInvalidPEMEd25519PublicKeyBanner  = errors.New("bytes did not contain a proper Ed25519 public key banner")
	ErrInvalidPEMEd25519PrivateKeyBanner = errors.New("bytes did not contain a proper Ed25519 private key banner")

	ErrNoPeerStaticKey = errors.New("no peer static key was present")
	ErrNoPayload       = errors.New("provided payload was empty")

	ErrMissingDetails  = errors.New("certificate did not contain details")
	ErrEmptySignature  = errors.New("empty signature")
	ErrEmptyRawDetails = errors.New("empty rawDetails not allowed")
)

type ErrInvalidCertificateProperties struct {
	str string
}

func NewErrInvalidCertificateProperties(format string, a ...any) error {
	return &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}
}

func (e *ErrInvalidCertificateProperties) Error() string {
	return e.str
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Ensure the certificate's details are set (via the constructor/unmarshal path) before calling Fingerprint or MarshalJSON
2. Validate the certificate source data — truncated input yields empty rawDetails
3. In tests, marshal the details first (details.Marshal()) so rawDetails is populated

Example fix

// before
c := &certificateV2{} // rawDetails never set
fp, err := c.Fingerprint()
// after
rd, err := nc.details.Marshal()
nc.rawDetails = rd
fp, err := nc.Fingerprint()

if len(c.rawDetails) == 0 {
    return fmt.Errorf("certificate has no details; cannot fingerprint")
}

func hasDetails(c interface{ Marshal() ([]byte, error) }) bool {
    _, err := c.Marshal()
    return err == nil
}

fp, err := c.Fingerprint()
if errors.Is(err, cert.ErrMissingDetails) {
    // rehydrate certificate from full encoded bytes before use
}

When it happens

Trigger: Calling Fingerprint() on a certificateV2 whose rawDetails is empty — typically a certificate constructed programmatically (or via unmarshalling) without ever having details set.

Common situations: Building a certificate in tests or tooling and forgetting to set details; unmarshalling a truncated/invalid certificate; JSON-marshalling a partially initialized certificateV2.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ErrFingerprintMismatch
• ErrEmptyRawDetails
• could not calculate fingerprint for provided CA; error: %w;
• could not calculate fingerprint to verify: %w
• could not calculate alternate fingerprint to verify: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/74951d0ac4693a5e. Report an issue: GitHub.