slackhq/nebula · error

error reading passphrase: %s

Error message

error reading passphrase: %s

What it means

While prompting up to five times for the encryption passphrase, the nebula-cert ca command wraps any read error (other than ErrNoTerminal) in "error reading passphrase: %s". The wrapped message contains the underlying terminal read failure (e.g. interrupted read, closed stdin, termios failure).

Source

Thrown at cmd/nebula-cert/ca.go:231

		"out-key", *cf.outKeyPath,
		"out-crt", *cf.outCertPath,
		"out-qr", *cf.outQRPath,
	); err != nil {
		return err
	}

	var passphrase []byte
	if !isP11 && *cf.encryption {
		passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
		if len(passphrase) == 0 {
			for i := 0; i < 5; i++ {
				errOut.Write([]byte("Enter passphrase: "))
				passphrase, err = pr.ReadPassword()

				if err == ErrNoTerminal {
					return fmt.Errorf("out-key must be encrypted interactively")
				} else if err != nil {
					return fmt.Errorf("error reading passphrase: %s", err)
				}

				if len(passphrase) > 0 {
					break
				}
			}

			if len(passphrase) == 0 {
				return fmt.Errorf("no passphrase specified, remove -encrypt flag to write out-key in plaintext")
			}
		}
	}

	var curve cert.Curve
	var pub, rawPriv []byte
	var p11Client *pkclient.PKClient

	if isP11 {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the wrapped %s message to identify the underlying read failure.
2. Run the command in a normal interactive terminal with stdin open.
3. Remove -encrypt if passphrase entry is impossible in your environment.
4. Retry the command; transient read interruptions (signals) usually succeed on a clean invocation.

Example fix

// before (stdin closed, e.g. via </dev/null)
nebula-cert ca -name "ca" -encrypt < /dev/null

// after
nebula-cert ca -name "ca" -encrypt  # run interactively

out, err := exec.Command("nebula-cert", "ca", "-encrypt", ...).CombinedOutput()
if err != nil && strings.Contains(string(out), "error reading passphrase") {
    // inspect wrapped cause; retry in a clean interactive terminal
    return err
}

When it happens

Trigger: Running `nebula-cert ca -encrypt` where pr.ReadPassword() fails with an error other than ErrNoTerminal — e.g. stdin closed mid-prompt, read interrupted by a signal, or a terminal driver error.

Common situations: Piping input into the command while -encrypt is set, terminal emulators killing the read on resize/signal, scripted automation closing stdin, or restricted environments where password reading is unsupported.

Related errors

• out-key must be encrypted interactively
• no passphrase specified, remove -encrypt flag to write out-k
• error while encrypting out-key: %s
• ca-key is encrypted and must be decrypted interactively
• invalid passphrase or corrupt private key

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e9ae563aeeabfe6c. Report an issue: GitHub.