What causes "error while marshalling certificate: %s" in slackhq/nebula?

Retry with standard flags (e.g. default 25519 curve) to rule out exotic combinations.

error while marshalling certificate: %s

Error message

error while marshalling certificate: %s

What it means

nebula-cert's `ca` subcommand failed to marshal the newly created CA certificate into PEM format via c.MarshalPEM(). This happens inside the certificate library before the cert is written out. The underlying marshalling error is embedded in the message.

Source

Thrown at cmd/nebula-cert/ca.go:356

		if *cf.encryption {
			b, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)
			if err != nil {
				return fmt.Errorf("error while encrypting out-key: %s", err)
			}
		} else {
			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
		}

		err = writeOutput(*cf.outKeyPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	b, err = c.MarshalPEM()
	if err != nil {
		return fmt.Errorf("error while marshalling certificate: %s", err)
	}

	err = writeOutput(*cf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *cf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*cf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

Retry with standard flags (e.g. default 25519 curve) to rule out exotic combinations.
Update nebula-cert to the latest version; this indicates a library-level failure.
If using PKCS#11 (-pkcs11), verify the returned public key is valid for the curve.
Report the embedded error upstream if it persists with supported flag combinations.

Defensive patterns

Strategy: try-catch

Try / catch

b, err := c.MarshalPEM()
if err != nil {
    return fmt.Errorf("error while marshalling certificate: %s", err)
}

Prevention

Keep nebula-cert and its certificate library up to date.
Use supported flag combinations and standard curves.
Validate PKCS#11-provided public keys before building the certificate.
Report persistent marshalling failures upstream with the embedded error.

When it happens

Trigger: Calling `nebula-cert ca` where the constructed certificate object cannot be serialized to PEM — e.g. an internal failure encoding the certificate structure for the selected curve.

Common situations: Rare in practice because the cert is freshly built internally; can appear with unusual flag combinations, corrupted PKCS#11-provided public keys, or a version mismatch between nebula-cert and its certificate library.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/6bdfd6c80c51e7ca. Report an issue: GitHub.