slackhq/nebula · error

error while adding ca cert to pool: %w

Error message

error while adding ca cert to pool: %w

What it means

The opened CA reader is parsed with cert.NewCAPoolFromPEMReader. If parsing fails with anything other than cert.ErrExpired (expired CAs are tolerated and reported later), verify wraps the error with this message. It indicates malformed or unparseable CA PEM data.

Source

Thrown at cmd/nebula-cert/verify.go:58

	}

	var claims ioClaims
	if err := reserveInputs(&claims,
		"ca", *vf.caPath,
		"crt", *vf.certPath,
	); err != nil {
		return err
	}

	caReader, err := openInput("ca", *vf.caPath, &claims)
	if err != nil {
		return fmt.Errorf("error while reading ca: %w", err)
	}
	defer caReader.Close()

	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
	if err != nil && !errors.Is(err, cert.ErrExpired) {
		return fmt.Errorf("error while adding ca cert to pool: %w", err)
	}

	rawCert, err := readInput("crt", *vf.certPath, &claims)
	if err != nil {
		return fmt.Errorf("unable to read crt: %w", err)
	}
	var errs []error
	for {
		if len(rawCert) == 0 {
			break
		}
		c, extra, err := cert.UnmarshalCertificateFromPEM(rawCert)
		if err != nil {
			return fmt.Errorf("error while parsing crt: %w", err)
		}
		rawCert = extra
		_, err = caPool.VerifyCertificate(time.Now(), c)
		if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Confirm the CA file contains valid 'BEGIN CERTIFICATE' PEM blocks (openssl x509 -in ca.pem -noout)
2. Re-copy/re-download the CA in PEM format
3. Check that the file is a CA certificate, not a leaf cert or private key
4. Inspect the wrapped inner error for the exact parse failure

import ("os"; "strings")
func looksLikePEM(path string) error {
    b, err := os.ReadFile(path)
    if err != nil { return err }
    if !strings.Contains(string(b), "-----BEGIN") {
        return errors.New("no PEM blocks in CA file")
    }
    return nil
}

out, err := exec.Command("nebula-cert", "verify", args...).CombinedOutput()
if err != nil && strings.Contains(string(out), "error while adding ca cert to pool") {
    log.Printf("CA PEM invalid: %s", out)
}

When it happens

Trigger: NewCAPoolFromPEMReader returns an error that is not ErrExpired: the CA file contains no valid PEM certificate blocks, corrupt/truncated PEM, or certificates that fail to unmarshal.

Common situations: CA file downloaded as HTML error page instead of PEM; concatenating the wrong file (e.g. a host cert as CA); PEM with Windows line-ending or encoding damage; empty CA file.

Related errors

• error while parsing crt: %w
• error while marshalling certificate: %s
• error while reading ca: %w
• ErrTruncatedPEMBlock
• input did not contain a valid PEM encoded block

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/5978f58a82f54f21. Report an issue: GitHub.