What causes "error computing issuer: %v" in slackhq/nebula?

Inspect the wrapped %v error for the root cause (usually a sha256 or marshal failure).

error computing issuer: %v

Error message

error computing issuer: %v

What it means

After signing, the issuer field is set to the signer certificate's SHA fingerprint via signer.Fingerprint(). If that fingerprint computation fails, SignWith wraps the underlying error with "error computing issuer". This indicates an internal failure while hashing the signer certificate's raw bytes.

Source

Thrown at cert/sign.go:94

// You should only use SignWith if you do not have direct access to your private key.
func (t *TBSCertificate) SignWith(signer Certificate, curve Curve, sp SignerLambda) (Certificate, error) {
	if curve != t.Curve {
		return nil, fmt.Errorf("curve in cert and private key supplied don't match")
	}

	if signer != nil {
		if t.IsCA {
			return nil, fmt.Errorf("can not sign a CA certificate with another")
		}

		err := checkCAConstraints(signer, t.NotBefore, t.NotAfter, t.Groups, t.Networks, t.UnsafeNetworks)
		if err != nil {
			return nil, err
		}

		issuer, err := signer.Fingerprint()
		if err != nil {
			return nil, fmt.Errorf("error computing issuer: %v", err)
		}
		t.issuer = issuer
	} else {
		if !t.IsCA {
			return nil, fmt.Errorf("self signed certificates must have IsCA set to true")
		}
	}

	var c beingSignedCertificate
	switch t.Version {
	case Version1:
		c = &certificateV1{}
		err := c.fromTBSCertificate(t)
		if err != nil {
			return nil, err
		}
	case Version2:
		c = &certificateV2{}

View on GitHub (pinned to dd8f660c0a)

Solutions

Inspect the wrapped %v error for the root cause (usually a sha256 or marshal failure).
Re-load or re-parse the signer certificate from a known-good PEM file.
Verify the signer came from cert.UnmarshalNebulaCertificate and parsed without error before signing.

Example fix

// before
signer, _ := cert.UnmarshalNebulaCertificate(rawBytes) // error ignored
root, err := cert.Sign(signer, key, t)

// after
signer, err := cert.UnmarshalNebulaCertificate(rawBytes)
if err != nil {
    return err
}
root, err := cert.Sign(signer, key, t)

Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := signer.Fingerprint(); err != nil {
    return fmt.Errorf("signer fingerprint invalid before signing: %w", err)
}

Try / catch

root, err := cert.Sign(signer, key, t)
if err != nil {
    var fe *fmt.Errorf
    if errors.As(err, &fe) && strings.Contains(err.Error(), "error computing issuer") {
        // re-load or re-parse the signer certificate
    }
    return err
}

Prevention

Always check the error from UnmarshalNebulaCertificate before using a cert as a signer.
Load signers from trusted, verified PEM files.
Avoid hand-crafted Certificate implementations with inconsistent Marshal output.

When it happens

Trigger: Calling SignWith/Sign with a valid signer whose Fingerprint() returns an error (e.g. corrupted or marshaled-empty signer certificate data).

Common situations: Passing a signer certificate that was improperly deserialized or truncated, memory/hash failures from a malformed certificate, or custom Certificate implementations whose Marshal returns inconsistent bytes.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/1710b737154373c5. Report an issue: GitHub.