slackhq/nebula · error

error while signing: %w

Error message

error while signing: %w

What it means

For v1 certificates, TBSCertificate.Sign(caCert, curve, caKey) failed while producing the signed certificate with a software-held CA key. The underlying error (e.g. key/curve incompatibility, marshalling failure) is wrapped in this message. Signing could not complete, so no certificate is written.

Source

Thrown at cmd/nebula-cert/sign.go:342

		t := &cert.TBSCertificate{
			Version:        cert.Version1,
			Name:           *sf.name,
			Networks:       []netip.Prefix{v4Networks[0]},
			Groups:         groups,
			UnsafeNetworks: v4UnsafeNetworks,
			NotBefore:      notBefore,
			NotAfter:       notAfter,
			PublicKey:      pub,
			IsCA:           false,
			Curve:          curve,
		}

		var nc cert.Certificate
		if p11Client == nil {
			nc, err = t.Sign(caCert, curve, caKey)
			if err != nil {
				return fmt.Errorf("error while signing: %w", err)
			}
		} else {
			nc, err = t.SignWith(caCert, curve, p11Client.SignASN1)
			if err != nil {
				return fmt.Errorf("error while signing with PKCS#11: %w", err)
			}
		}

		crts = append(crts, nc)

	case cert.Version2:
		t := &cert.TBSCertificate{
			Version:        cert.Version2,
			Name:           *sf.name,
			Networks:       append(v4Networks, v6Networks...),
			Groups:         groups,
			UnsafeNetworks: append(v4UnsafeNetworks, v6UnsafeNetworks...),
			NotBefore:      notBefore,

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Confirm -curve matches the actual CA private key curve; regenerate or re-specify accordingly
2. Re-inspect the wrapped error for the root cause (key parsing vs signing) and fix the CA key file
3. Recreate the CA with `nebula-cert ca -curve ...` if the key/cert pair is corrupt or mismatched

Example fix

// before
nebula-cert sign -ca ca.pem -key ca.key -curve CURVE25519 ...  # ca.key is actually P-256
// after
nebula-cert sign -ca ca.pem -key ca.key -curve P256 ...

# shell: confirm CA key curve matches the -curve flag before signing
nebula-cert print -path ca.pem | grep -i curve
# pass the same value to -curve (or omit and let it derive from CA)

if err := runSignCmd(); err != nil {
    if strings.Contains(err.Error(), "error while signing:") {
        // log the wrapped cause; verify CA key parses with `nebula-cert print -path ca.key`
    }
    return err
}

When it happens

Trigger: Running nebula-cert sign for a Version1 certificate when t.Sign fails — typically a CA key that does not match the declared curve, a corrupt/unsupported CA key, or an internal signing failure.

Common situations: CA key file rotated to a different curve than -curve argument; malformed ca.key PEM; using a CA cert whose key pair is inconsistent; go crypto signing returning an unsupported-key error.

Related errors

• curve of in-pub does not match ca
• error while signing with PKCS#11: %w
• no certificate state
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/056820b2006a0c36. Report an issue: GitHub.