slackhq/nebula · error

error while creating PKCS#11 client: %w

Error message

error while creating PKCS#11 client: %w

What it means

nebula-cert failed to construct the PKCS#11 client from the -pkcs11 URL (pkclient.FromUrl) during key generation. The underlying error is wrapped with %w, so the root cause (bad URL, missing module, token issues) is embedded.

Source

Thrown at cmd/nebula-cert/keygen.go:90

			pub, rawPriv = p256Keypair()
			curve = cert.Curve_P256
		default:
			return fmt.Errorf("invalid curve: %s", *cf.curve)
		}
	}

	var claims ioClaims
	if err := reserveOutputs(&claims,
		"out-key", *cf.outKeyPath,
		"out-pub", *cf.outPubPath,
	); err != nil {
		return err
	}

	if isP11 {
		p11Client, err := pkclient.FromUrl(*cf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key: %w", err)
		}
	} else {
		err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}
	err = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-pub: %s", err)
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the -pkcs11-url syntax and that it points to a reachable, existing PKCS#11 module.
2. Verify the HSM/smartcard is connected and the PKCS#11 shared library is installed (ldd on the module).
3. Test the module independently (pkcs11-tool --module <lib> -L) to list slots.
4. Read the wrapped cause in the message for the exact failure (module load vs token login).

Example fix

// before
nebula-cert keygen -pkcs11 -pkcs11-url /usr/lib/softhsm.so2 ...
// after (correct module filename)
nebula-cert keygen -pkcs11 -pkcs11-url /usr/lib/softhsm/libsofthsm2.so ...

#!/bin/sh
MODULE=$(echo "$P11_URL" | sed 's/^pkcs11://;s/?.*//')
[ -f "$MODULE" ] || { echo "PKCS#11 module $MODULE not found" >&2; exit 1; }
pkcs11-tool --module "$MODULE" -L >/dev/null 2>&1 || { echo "module init failed" >&2; exit 1; }

When it happens

Trigger: Running `nebula-cert keygen -pkcs11 -pkcs11-url <url>` where the URL is malformed, the PKCS#11 module cannot be loaded, or the client cannot initialize against the token/slot.

Common situations: Missing or misconfigured PKCS#11 module path in the URL; HSM not connected or daemon (e.g. p11-kit/pkcs11-proxy) not running; wrong slot/PIN encoded in the URL; module shared-object not installed in the container image.

Related errors

• error while creating PKCS#11 client: %w
• error while getting public key with PKCS#11: %w
• error while getting public key: %w
• notImplemented
• invalid curve for PKCS#11: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/445c35b4711b8d64. Report an issue: GitHub.