slackhq/nebula · error

error while reading ca-crt: %s

Error message

error while reading ca-crt: %s

What it means

Wraps an error from readInput while loading the CA certificate file (ca-crt) during nebula-cert sign. Unlike the ca-key branch, the raw ca-crt is read unconditionally after key handling, so this fires when the CA cert path (-ca-crt) is wrong, the file is missing, unreadable, or empty. The wrapped readInput error names the underlying OS cause; the cert is never parsed, so signing cannot proceed.

Source

Thrown at cmd/nebula-cert/sign.go:178

						break
					}
				}
				if len(passphrase) == 0 {
					return fmt.Errorf("cannot open encrypted ca-key without passphrase")
				}
			}
			curve, caKey, _, err = cert.DecryptAndUnmarshalSigningPrivateKey(passphrase, rawCAKey)
			if err != nil {
				return fmt.Errorf("error while parsing encrypted ca-key: %s", err)
			}
		} else if err != nil {
			return fmt.Errorf("error while parsing ca-key: %s", err)
		}
	}

	rawCACert, err := readInput("ca-crt", *sf.caCertPath, &claims)
	if err != nil {
		return fmt.Errorf("error while reading ca-crt: %s", err)
	}

	caCert, _, err := cert.UnmarshalCertificateFromPEM(rawCACert)
	if err != nil {
		return fmt.Errorf("error while parsing ca-crt: %s", err)
	}

	if !isP11 {
		if err := caCert.VerifyPrivateKey(curve, caKey); err != nil {
			return fmt.Errorf("refusing to sign, root certificate does not match private key")
		}
	}

	if caCert.Expired(time.Now()) {
		return fmt.Errorf("ca certificate is expired")
	}

	if version == 0 {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Verify the -ca-crt path exists and is readable
2. Check file permissions and that no stdin/pipe redirection was intended

When it happens

Trigger: Thrown at cmd/nebula-cert/sign.go:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/1ee8b7b05aaea8ba. Report an issue: GitHub.