slackhq/nebula · error

error while getting public key with PKCS#11: %w

Error message

error while getting public key with PKCS#11: %w

What it means

When -pkcs11 is used, the public key is not read from a file but fetched from the HSM/token via p11Client.GetPubKey() (cmd/nebula-cert/sign.go:291). If the token operation fails (slot/login/URL problems or key not found), the underlying error is wrapped and returned. The command cannot proceed because it needs the token-held public key to embed in the new certificate.

Source

Thrown at cmd/nebula-cert/sign.go:293

	if *sf.inPubPath != "" {
		var pubCurve cert.Curve
		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
		if err != nil {
			return fmt.Errorf("error while reading in-pub: %s", err)
		}

		pub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)
		if err != nil {
			return fmt.Errorf("error while parsing in-pub: %s", err)
		}
		if pubCurve != curve {
			return fmt.Errorf("curve of in-pub does not match ca")
		}
	} else if isP11 {
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key with PKCS#11: %w", err)
		}
	} else {
		pub, rawPriv = newKeypair(curve)
	}

	if !isStdio(*sf.outCertPath) {
		if _, err := os.Stat(*sf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
		}
	}

	var crts []cert.Certificate

	notBefore := time.Now()
	notAfter := notBefore.Add(*sf.duration)

	switch version {
	case cert.Version1:

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Verify the PKCS#11 URI and module library path; test with pkcs11-tool --list-objects to confirm the key exists
2. Ensure the token is present and logged in (correct PIN/session) before running the command
3. Check that the referenced key object id/label matches the URI; regenerate or re-import the key if missing

Example fix

// before
nebula-cert sign -pkcs11 -p11-url 'pkcs11:token=WRONGTOKEN;object=nebula' ...
// after
nebula-cert sign -pkcs11 -p11-url 'pkcs11:token=nebula-hsm;object=nebula;pin-source=/etc/nebula/pin' ...

# shell: check token and key exist before signing
pkcs11-tool --module /usr/lib/softhsm.so --list-objects --token-label nebula
# confirm the URI in -p11-url matches token/label/id above

if err := runSignCmd(); err != nil {
    var p11Err *pkclient.Error
    if errors.As(err, &p11Err) {
        // inspect CKR code, re-login or re-open session, then retry once
    }
    return err
}

When it happens

Trigger: Running `nebula-cert sign -pkcs11 ...` when the PKCS#11 URI is wrong, the token is not logged in, the private key object cannot be located, or the HSM library fails during GetPubKey.

Common situations: Wrong -p11-url / missing module path; token not plugged in or locked; user not logged into the slot; key object absent from the token; FIPS/ACL policies denying public-key export or derivation.

Related errors

• error while signing with PKCS#11: %w
• no certificate state
• notImplemented
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/14845f480a7462be. Report an issue: GitHub.