slackhq/nebula · error

error while creating PKCS#11 client: %w

Error message

error while creating PKCS#11 client: %w

What it means

pkclient.FromUrl() failed to create the PKCS#11 client (module load, URL parsing, or token/session setup), and the ca command wraps it with "error while creating PKCS#11 client: %w". The wrapped cause names the concrete failure from the pkcs11 layer.

Source

Thrown at cmd/nebula-cert/ca.go:259

			}
		}
	}

	var curve cert.Curve
	var pub, rawPriv []byte
	var p11Client *pkclient.PKClient

	if isP11 {
		switch *cf.curve {
		case "P256":
			curve = cert.Curve_P256
		default:
			return fmt.Errorf("invalid curve for PKCS#11: %s", *cf.curve)
		}

		p11Client, err = pkclient.FromUrl(*cf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key with PKCS#11: %w", err)
		}
	} else {
		switch *cf.curve {
		case "25519", "X25519", "Curve25519", "CURVE25519":
			if fips140.Enforced() {
				return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
			}
			curve = cert.Curve_CURVE25519
			pub, rawPriv, err = ed25519.GenerateKey(rand.Reader)
			if err != nil {
				return fmt.Errorf("error while generating ed25519 keys: %s", err)

View on GitHub (pinned to dd8f660c0a)

Solutions

  1. Read the wrapped %w cause — it pinpoints URI parsing vs module loading vs session failure.
  2. Verify the PKCS#11 URI is well-formed and points at an existing token/slot.
  3. Ensure the PKCS#11 module shared library is installed and loadable on the host (check its path and permissions).
  4. Confirm the HSM/token is connected, initialized, and accessible by the user running nebula-cert.
  5. Test the token with p11tool/pkcs11-tool using the same URI to isolate the problem.

Example fix

// before (missing module library)
nebula-cert ca -name "ca" -p11url "p11://token=ca"

// after (install module and pass full URI)
apt install opensc  # provides pkcs11.so
nebula-cert ca -name "ca" -p11url "p11://module=/usr/lib/softhsm/libsofthsm2.so;token=ca"
Defensive patterns

Strategy: try-catch

Validate before calling

// preflight: open the PKCS#11 module before running the CA command
// e.g. run: pkcs11-tool --module <so> --list-slots --token-label <token>
// and only proceed if it succeeds

Try / catch

out, err := exec.Command("nebula-cert", "ca", "-p11url", uri, ...).CombinedOutput()
if err != nil && strings.Contains(string(out), "error while creating PKCS#11 client") {
    // unwrap cause: check URI, module path, and token availability
    return err
}

Prevention

When it happens

Trigger: Running `nebula-cert ca -p11url <url>` where FromUrl errors: malformed PKCS#11 URI, missing/unloadable PKCS#11 module (.so), HSM not connected, or bad token/slot configuration.

Common situations: HSM not plugged in or locked, wrong PKCS#11 URI scheme/path, missing PKCS#11 shared library on the host, environment lacking PKCS11_MODULE configuration, or insufficient permissions to open the token device.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/5c250a0c58133fbc. Report an issue: GitHub.