What causes "error while generating qr code: %s" in slackhq/nebula?

Reduce certificate size: shorten group names/host name, or fewer groups

error while generating qr code: %s

Error message

error while generating qr code: %s

What it means

After collecting the PEM bytes, printCert encodes them into a QR image with qrcode.Encode(string(qrBytes), qrcode.Medium, -5); an encoding failure is wrapped as "error while generating qr code". This happens when the payload exceeds what a QR code at the chosen recovery level can physically store.

Source

Thrown at cmd/nebula-cert/print.go:105

		}

		if rawCert == nil || len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == "" {
			break
		}

		part++
	}

	if *pf.json && !qrToStdout {
		b, _ := json.Marshal(jsonCerts)
		_, _ = out.Write(b)
		_, _ = out.Write([]byte("\n"))
	}

	if *pf.outQRPath != "" {
		b, err := qrcode.Encode(string(qrBytes), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*pf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func printSummary() string {
	return "print <flags>: prints details about a certificate"
}

func printHelp(out io.Writer) {
	pf := newPrintFlags()
	out.Write([]byte("Usage of " + os.Args[0] + " " + printSummary() + "\n"))

View on GitHub (pinned to dd8f660c0a)

Solutions

Reduce certificate size: shorten group names/host name, or fewer groups
QR-encode a single certificate instead of a multi-cert bundle
Use a larger output or lower-capacity requirement: try a different recovery level / newer qrcode library version
Distribute the payload across multiple QR outputs rather than one

Example fix

// before
nebula-cert print -path ca-and-host-bundle.crt -out-qr qr.png   # bundle too large for one QR
// after
nebula-cert print -path host.crt -out-qr qr.png                 # single cert fits

Defensive patterns

Strategy: validation

Validate before calling

pemLen := len(strings.TrimSpace(pemData))
if pemLen > 2000 {
    return fmt.Errorf("payload of %d bytes too large for a single QR code", pemLen)
}

Try / catch

if err := printCert(args, out, errOut); err != nil {
    if strings.Contains(err.Error(), "error while generating qr code") {
        log.Printf("cert too large for QR: %v; print without -out-qr instead", err)
    }
}

Prevention

Keep certificates small: short host/group names
QR-encode only single certificates, not bundles
Fall back to file/PEM distribution when certs are large
Test QR output with your largest real certificate

When it happens

Trigger: `nebula-cert print ... -out-qr out.png` where qrBytes (one or more full certificate PEMs) exceed the QR medium-recovery capacity, or the qrcode library rejects the data size at the given recovery level (-5 means minimum size hint)

Common situations: printing very large certificates (long host names, many groups, big public keys) or multi-certificate bundles where combined PEM size exceeds QR capacity; requesting QR of an entire CA-signed bundle

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/2636c3eca1c745f3. Report an issue: GitHub.