What causes "error while generating qr code: %s" in slackhq/nebula?

Reduce certificate size: shorten -name, trim -groups and -subnets entries

error while generating qr code: %s

Error message

error while generating qr code: %s

What it means

When -out-qr is set, signCert encodes the PEM certificate text into a QR code PNG using qrcode.Encode at medium error-correction. If the QR encoder fails, the error is wrapped with this message and signing aborts after the certificate was already written.

Source

Thrown at cmd/nebula-cert/sign.go:416

	var b []byte
	for _, c := range crts {
		sb, err := c.MarshalPEM()
		if err != nil {
			return fmt.Errorf("error while marshalling certificate: %s", err)
		}
		b = append(b, sb...)
	}

	err = writeOutput(*sf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *sf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*sf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func newKeypair(curve cert.Curve) ([]byte, []byte) {
	switch curve {
	case cert.Curve_CURVE25519:
		return x25519Keypair()
	case cert.Curve_P256:
		return p256Keypair()
	default:

View on GitHub (pinned to dd8f660c0a)

Solutions

Reduce certificate size: shorten -name, trim -groups and -subnets entries
Drop the -out-qr flag and transfer the .crt file directly instead of via QR
Update the qr dependency (skip-2/go-qrcode) via go get -u and rebuild

Defensive patterns

Strategy: try-catch

Validate before calling

// Rough pre-check: QR capacity is ~2953 bytes at byte mode / low EC level
if len(pemBytes) > 2900 {
    return errors.New("certificate too large for QR encoding; skip -out-qr")
}

Try / catch

if err := cmd.Run(); err != nil {
    if strings.Contains(err.Error(), "error while generating qr code") {
        log.Printf("cert too large for QR: %v", err)
    }
}

Prevention

Keep certificate names/groups/subnets small if using QR distribution
Only pass -out-qr when you actually need QR delivery
Distribute .crt files directly on larger certs

When it happens

Trigger: qrcode.Encode(string(b), qrcode.Medium, -5) returns an error — practically, the payload (certificate PEM) exceeds QR code capacity or the encoder cannot produce a code for the input.

Common situations: Very large certificates (long names, many subnets/groups) producing PEM text too large for a single QR code; misconfigured certificate fields inflating size.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e91b383185813e9f. Report an issue: GitHub.