slackhq/nebula · error

error while parsing crt: %w

Error message

error while parsing crt: %w

What it means

Each PEM block from the -crt input is parsed with cert.UnmarshalCertificateFromPEM. If the bytes are not a valid Nebula certificate PEM, the parse error is wrapped with this message. Note the loop expects potentially multiple concatenated certificates; the first unparseable block aborts.

Source

Thrown at cmd/nebula-cert/verify.go:72

	defer caReader.Close()

	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
	if err != nil && !errors.Is(err, cert.ErrExpired) {
		return fmt.Errorf("error while adding ca cert to pool: %w", err)
	}

	rawCert, err := readInput("crt", *vf.certPath, &claims)
	if err != nil {
		return fmt.Errorf("unable to read crt: %w", err)
	}
	var errs []error
	for {
		if len(rawCert) == 0 {
			break
		}
		c, extra, err := cert.UnmarshalCertificateFromPEM(rawCert)
		if err != nil {
			return fmt.Errorf("error while parsing crt: %w", err)
		}
		rawCert = extra
		_, err = caPool.VerifyCertificate(time.Now(), c)
		if err != nil {
			switch {
			case errors.Is(err, cert.ErrCaNotFound):
				errs = append(errs, fmt.Errorf("error while verifying certificate v%d %s with issuer %s: %w", c.Version(), c.Name(), c.Issuer(), err))
			default:
				errs = append(errs, fmt.Errorf("error while verifying certificate %+v: %w", c, err))
			}
		}
	}

	return errors.Join(errs...)
}

func verifySummary() string {
	return "verify <flags>: verifies a certificate isn't expired and was signed by a trusted authority."

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Confirm the file was generated by nebula-cert (header should be a Nebula PEM block, not 'BEGIN CERTIFICATE' X.509 from another CA)
2. Regenerate the certificate with nebula-cert sign
3. Check you are not pointing -crt at the CA or key file
4. Verify the file was not truncated or altered in transfer

Example fix

// before
./nebula-cert verify -ca ca.crt -crt openssl-host.pem   # X.509, not Nebula
// after
./nebula-cert sign -ca ca.crt -key ca.key -name host -out-crt host.crt
./nebula-cert verify -ca ca.crt -crt host.crt

import ("os"; "strings")
func looksLikeNebulaCert(path string) error {
    b, err := os.ReadFile(path)
    if err != nil { return err }
    s := string(b)
    if strings.Contains(s, "PRIVATE KEY") {
        return errors.New("passed a key file, not a certificate")
    }
    if !strings.Contains(s, "-----BEGIN") {
        return errors.New("not a PEM certificate")
    }
    return nil
}

out, err := exec.Command("nebula-cert", "verify", args...).CombinedOutput()
if err != nil && strings.Contains(string(out), "error while parsing crt") {
    log.Printf("not a valid Nebula cert: %s", out)
}

When it happens

Trigger: UnmarshalCertificateFromPEM(rawCert) fails: the file holds a standard X.509 PEM instead of a Nebula certificate, is empty, contains a private key, or the PEM block is corrupt.

Common situations: Pointing -crt at an X.509 cert from another PKI instead of a nebula-cert-signed certificate; pointing at the CA file by mistake; passing a key file; truncated or base64-mangled cert from copy/paste.

Related errors

• error while adding ca cert to pool: %w
• error while marshalling certificate: %s
• ErrTruncatedPEMBlock
• input did not contain a valid PEM encoded block
• bytes did not contain a proper nebula encrypted Ed25519/ECDS

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/8feb03de2ca60fa9. Report an issue: GitHub.