What causes "error while signing: %s" in slackhq/nebula?

Fix any upstream key-generation failure first (this error usually follows one)

error while signing: %s

Error message

error while signing: %s

What it means

Wraps a failure from t.Sign(nil, curve, rawPriv) when signing the CA certificate locally with the freshly generated raw private key in `nebula-cert ca`. Signing is done in-process over the TBSCertificate, so failure indicates the crypto/sign operation itself rejected the key/curve combination rather than any I/O problem.

Source

Thrown at cmd/nebula-cert/ca.go:336

	if !isStdio(*cf.outCertPath) {
		if _, err := os.Stat(*cf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
		}
	}

	var c cert.Certificate
	var b []byte

	if isP11 {
		c, err = t.SignWith(nil, curve, p11Client.SignASN1)
		if err != nil {
			return fmt.Errorf("error while signing with PKCS#11: %w", err)
		}
	} else {
		c, err = t.Sign(nil, curve, rawPriv)
		if err != nil {
			return fmt.Errorf("error while signing: %s", err)
		}

		if *cf.encryption {
			b, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)
			if err != nil {
				return fmt.Errorf("error while encrypting out-key: %s", err)
			}
		} else {
			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
		}

		err = writeOutput(*cf.outKeyPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	b, err = c.MarshalPEM()

View on GitHub (pinned to dd8f660c0a)

Solutions

Fix any upstream key-generation failure first (this error usually follows one)
Rerun the command; local signing of a fresh key is deterministic and should succeed
Verify unmodified Go crypto packages (no vendored overrides)
If reproducible with stock builds, report to nebula maintainers with the wrapped error

Defensive patterns

Strategy: try-catch

Try / catch

out, err := exec.Command("nebula-cert", "ca", ...).CombinedOutput()
if err != nil && strings.Contains(string(out), "error while signing") && !strings.Contains(string(out), "PKCS#11") {
	log.Printf("local signing failed: %s", out)
	return fmt.Errorf("cert signing failed: %s", out)
}

Prevention

Resolve any upstream key-generation errors first — this failure usually follows one
Keep Go crypto packages unmodified (no vendor patches)
If persistent on stock builds, capture the wrapped error and report upstream

When it happens

Trigger: nebula-cert ca (non-PKCS#11) where t.Sign fails — practically limited to an unusable/zero rawPriv (e.g. a Curve25519 key generated in a broken environment) or a crypto library rejecting the signature input.

Common situations: Broken key generation upstream (empty rawPriv due to earlier environment failure); patched or custom crypto builds; inconsistent key/curve pairing in modified code.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/09c8084e695f0af7. Report an issue: GitHub.