slackhq/nebula · error

error while marshalling cert to PEM: %s

Error message

error while marshalling cert to PEM: %s

What it means

When -out-qr is set, printCert marshals each parsed certificate to PEM via c.MarshalPEM() and concatenates the bytes for QR encoding; failure is wrapped with this message. It means the in-memory certificate object could not be re-serialized to PEM, which is a rare internal/encoding failure rather than a file problem.

Source

Thrown at cmd/nebula-cert/print.go:84

	for {
		c, rawCert, err = cert.UnmarshalCertificateFromPEM(rawCert)
		if err != nil {
			return fmt.Errorf("error while unmarshaling cert: %s", err)
		}

		if !qrToStdout {
			if *pf.json {
				jsonCerts = append(jsonCerts, c)
			} else {
				_, _ = out.Write([]byte(c.String()))
				_, _ = out.Write([]byte("\n"))
			}
		}

		if *pf.outQRPath != "" {
			b, err := c.MarshalPEM()
			if err != nil {
				return fmt.Errorf("error while marshalling cert to PEM: %s", err)
			}
			qrBytes = append(qrBytes, b...)
		}

		if rawCert == nil || len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == "" {
			break
		}

		part++
	}

	if *pf.json && !qrToStdout {
		b, _ := json.Marshal(jsonCerts)
		_, _ = out.Write(b)
		_, _ = out.Write([]byte("\n"))
	}

	if *pf.outQRPath != "" {

View on GitHub (pinned to dd8f660c0a)

Solutions

  1. Upgrade nebula-cert to the latest version (encoding fixes land upstream)
  2. Test printing without -out-qr to isolate whether the failure is QR/PEM marshalling or general printing
  3. Regenerate the offending certificate from the CA
  4. Report upstream with the certificate structure if a valid cert consistently fails

Example fix

// before
nebula-cert print -path cert.crt -out-qr qr.png   # fails marshalling
// after
nebula-cert print -path cert.crt                  # confirm basic print works, then retry QR with updated binary
Defensive patterns

Strategy: try-catch

Validate before calling

if err := printCert(args, out, errOut); err == nil {
    // basic print works; QR PEM marshalling path is safe to attempt
}

Try / catch

if err := printCert(args, out, errOut); err != nil {
    if strings.Contains(err.Error(), "error while marshalling cert to PEM") {
        log.Printf("PEM re-encode failed, printing without -out-qr: %v", err)
        // fallback: run again without -out-qr
    }
}

Prevention

When it happens

Trigger: `nebula-cert print -path cert.crt -out-qr qr.png` where c.MarshalPEM() returns an error for one of the certificates in the input (malformed certificate structure that parsed but cannot re-encode)

Common situations: processing unusual or edge-case certificates (e.g. very large or oddly-structured certs) while generating a QR bundle; multi-cert bundles where one member fails to re-encode

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/bb479be88c782734. Report an issue: GitHub.