slackhq/nebula · error

error while marshalling certificate: %s

Error message

error while marshalling certificate: %s

What it means

signCert in the nebula-cert CLI fails while serializing a generated Nebula certificate to PEM. After signing, each certificate is marshalled with MarshalPEM(); if that returns an error (indicating a certificate failed to encode), the error is wrapped with this message and returned, aborting the sign operation before any output file is written.

Source

Thrown at cmd/nebula-cert/sign.go:403

	if !isP11 && *sf.inPubPath == "" {
		if !isStdio(*sf.outKeyPath) {
			if _, err := os.Stat(*sf.outKeyPath); err == nil {
				return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
			}
		}

		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	var b []byte
	for _, c := range crts {
		sb, err := c.MarshalPEM()
		if err != nil {
			return fmt.Errorf("error while marshalling certificate: %s", err)
		}
		b = append(b, sb...)
	}

	err = writeOutput(*sf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *sf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*sf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Re-run the command; if reproducible, check the nebula-cert version matches the nebula-cert library version used at build time
2. Update nebula-cert to the latest release and rebuild
3. Report the underlying MarshalPEM error (check the %s detail) upstream if it persists

// Go: ensure cert marshals before writing
if _, err := c.MarshalPEM(); err != nil {
    return fmt.Errorf("pre-flight marshal failed: %w", err)
}

if err := runSign(); err != nil {
    if strings.Contains(err.Error(), "error while marshalling certificate") {
        log.Printf("cert marshal failed: %v", err)
    }
}

When it happens

Trigger: c.MarshalPEM() returns a non-nil error while iterating over the certificates produced by signCert — e.g. the underlying cert struct is in a state that cannot be PEM-encoded.

Common situations: A bug or version mismatch between the signing code and the cert library; an internal failure marshalling a just-signed certificate. Rarely hit by end users since the certificate was just built in memory.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ErrTruncatedPEMBlock
• error while marshalling certificate: %s
• error while generating qr code: %s
• error while adding ca cert to pool: %w
• unable to read crt: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c143d0fdd476a06a. Report an issue: GitHub.