slackhq/nebula · error

error while getting public key: %w

Error message

error while getting public key: %w

What it means

nebula-cert's PKCS#11 key generation failed when retrieving the public key from the token via p11Client.GetPubKey(). The client was created successfully, but the HSM could not return the public half of the key; the underlying error is wrapped with %w.

Source

Thrown at cmd/nebula-cert/keygen.go:97

	var claims ioClaims
	if err := reserveOutputs(&claims,
		"out-key", *cf.outKeyPath,
		"out-pub", *cf.outPubPath,
	); err != nil {
		return err
	}

	if isP11 {
		p11Client, err := pkclient.FromUrl(*cf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key: %w", err)
		}
	} else {
		err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}
	err = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-pub: %s", err)
	}

	return nil
}

func keygenSummary() string {
	return "keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`"
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Verify the key label/ID in the -pkcs11-url matches an object present on the token (pkcs11-tool -O).
2. Supply a correct PIN/token login in the PKCS#11 URL or environment.
3. Reconnect the token/HSM and retry the keygen command.
4. Read the wrapped cause in the message to distinguish login failure from missing object.

Example fix

// before
nebula-cert keygen -pkcs11 -pkcs11-url "pkcs11:token=mytoken" ...
// after (pin included)
nebula-cert keygen -pkcs11 -pkcs11-url "pkcs11:token=mytoken;pin=1234" ...

#!/bin/sh
# Confirm the token and key object exist before keygen
pkcs11-tool --module "$MODULE" --list-objects | grep -q "$KEY_LABEL" \
  || { echo "key object $KEY_LABEL not on token" >&2; exit 1; }

When it happens

Trigger: Running `nebula-cert keygen -pkcs11 ...` where GetPubKey fails: the key object does not exist on the token, the session is not logged in, the slot/token was removed mid-operation, or the mechanism/key attributes are wrong.

Common situations: Key label/ID in the PKCS#11 URL not matching an object on the token; PIN not supplied or wrong so C_Login fails; token unplugged or HSM session expired; hardware that does not expose the public key for the requested key.

Related errors

• error while creating PKCS#11 client: %w
• error while getting public key with PKCS#11: %w
• error while creating PKCS#11 client: %w
• notImplemented
• invalid curve for PKCS#11: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/3c25d16742d1ae24. Report an issue: GitHub.