slackhq/nebula · error

error while generating qr code: %s

Error message

error while generating qr code: %s

What it means

Wrapping error in nebula-cert ca when qrcode.Encode fails to render the marshalled certificate PEM into a PNG QR code. The underlying failure is included with %s; typical causes are payload too large for the requested QR size/level (long certificates at qrcode.Medium, negative size auto-fit failing).

Source

Thrown at cmd/nebula-cert/ca.go:367

		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	b, err = c.MarshalPEM()
	if err != nil {
		return fmt.Errorf("error while marshalling certificate: %s", err)
	}

	err = writeOutput(*cf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *cf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*cf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func caSummary() string {
	return "ca <flags>: create a self signed certificate authority"
}

func caHelp(out io.Writer) {
	cf := newCaFlags()
	out.Write([]byte("Usage of " + os.Args[0] + " " + caSummary() + "\n"))

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Shorten the CA -name / subnets to reduce certificate size.
2. Skip the -out-qr flag and distribute ca.crt by file instead.
3. Update nebula-cert in case a newer qrcode library raises capacity limits.
4. Use the embedded error text to confirm it is a QR capacity issue.

Example fix

// before
nebula-cert ca -name a-very-long-organization-name-with-many-details -out-qr ca-qr.png
// after
nebula-cert ca -name org -out-qr ca-qr.png

// QR capacity is bounded; keep the CA certificate small.
// Check name length before running:
if [ ${#CA_NAME} -gt 64 ]; then
  echo "CA name too long for QR output; drop -out-qr" >&2
  exit 1
fi

When it happens

Trigger: Running `nebula-cert ca -out-qr <path>` where the qrcode encoder rejects the payload — typically because the certificate PEM string exceeds the encoder's capacity at the chosen recovery level (Medium) and scale (-5).

Common situations: Very large CA certificates (long names, unusual field contents) producing PEM too long for a QR code; rare otherwise since the payload size is fixed at Medium/-5 internally.

Related errors

• error while writing out-key: %s
• error while writing out-crt: %s
• error while writing out-qr: %s
• error while generating qr code: %s
• error while reading ca: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/44c5cc21c02a1ef2. Report an issue: GitHub.