slackhq/nebula · error

error while creating PKCS#11 client: %w

Error message

error while creating PKCS#11 client: %w

What it means

Wrapping error in signCert when -p11url is set: pkclient.FromUrl failed to construct a PKCS#11 HSM client. The URL could not be parsed, the module could not be loaded, or the token/slot was not found; the underlying error is preserved with %w.

Source

Thrown at cmd/nebula-cert/sign.go:265

	var groups []string
	if *sf.groups != "" {
		for _, rg := range strings.Split(*sf.groups, ",") {
			g := strings.TrimSpace(rg)
			if g != "" {
				groups = append(groups, g)
			}
		}
	}

	var pub, rawPriv []byte
	var p11Client *pkclient.PKClient

	if isP11 {
		curve = cert.Curve_P256
		p11Client, err = pkclient.FromUrl(*sf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
	}

	if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
		return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
	}

	if *sf.inPubPath != "" {
		var pubCurve cert.Curve
		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
		if err != nil {
			return fmt.Errorf("error while reading in-pub: %s", err)
		}

		pub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the pkcs11 URI syntax (module path, slot, token, PIN)
2. Verify the HSM/PKCS#11 module is installed and the token is present
3. Confirm the process can access the PKCS#11 library file

When it happens

Trigger: Thrown at cmd/nebula-cert/sign.go:265 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ce2a8624d65f8e43. Report an issue: GitHub.