slackhq/nebula · error

error while signing with PKCS#11: %w

Error message

error while signing with PKCS#11: %w

What it means

For v1 certificates with PKCS#11 mode, TBSCertificate.SignWith(caCert, curve, p11Client.SignASN1) failed. The HSM-side ASN.1 signature operation returned an error, which is wrapped here. Without the token's signature, the v1 certificate cannot be finalized.

Source

Thrown at cmd/nebula-cert/sign.go:347

			Groups:         groups,
			UnsafeNetworks: v4UnsafeNetworks,
			NotBefore:      notBefore,
			NotAfter:       notAfter,
			PublicKey:      pub,
			IsCA:           false,
			Curve:          curve,
		}

		var nc cert.Certificate
		if p11Client == nil {
			nc, err = t.Sign(caCert, curve, caKey)
			if err != nil {
				return fmt.Errorf("error while signing: %w", err)
			}
		} else {
			nc, err = t.SignWith(caCert, curve, p11Client.SignASN1)
			if err != nil {
				return fmt.Errorf("error while signing with PKCS#11: %w", err)
			}
		}

		crts = append(crts, nc)

	case cert.Version2:
		t := &cert.TBSCertificate{
			Version:        cert.Version2,
			Name:           *sf.name,
			Networks:       append(v4Networks, v6Networks...),
			Groups:         groups,
			UnsafeNetworks: append(v4UnsafeNetworks, v6UnsafeNetworks...),
			NotBefore:      notBefore,
			NotAfter:       notAfter,
			PublicKey:      pub,
			IsCA:           false,
			Curve:          curve,
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the wrapped PKCS#11 error and token logs for the failing mechanism (CKR_ code)
2. Verify the token session/login and that the key object supports the signing mechanism for the CA curve
3. Test signing independently (pkcs11-tool --sign) to isolate HSM vs nebula configuration

Example fix

// before
nebula-cert sign -pkcs11 -p11-url 'pkcs11:token=nebula;object=nebula' ...  # not logged in
// after
nebula-cert sign -pkcs11 -p11-url 'pkcs11:token=nebula;object=nebula;pin-source=/etc/nebula/pin' ...

# shell: preflight HSM signing capability
pkcs11-tool --module $MODULE --token-label nebula --test --login --pin-file /etc/nebula/pin

if err := runSignCmd(); err != nil {
    if strings.Contains(err.Error(), "error while signing with PKCS#11") {
        // check CKR code: transient errors (CKR_DEVICE_ERROR, CKR_SESSION_CLOSED) may be retried
        // login errors need re-authentication, not retry
    }
    return err
}

When it happens

Trigger: Running `nebula-cert sign -pkcs11 ...` for a Version1 cert when the token's SignASN1 call fails — bad login/session, key not found, mechanism unsupported for the curve, or HSM error.

Common situations: Token requires login but none configured; HSM does not support the required ECDSA/EdDSA mechanism; key object locked by policy; transient PKCS#11 library failure.

Related errors

• error while getting public key with PKCS#11: %w
• error while signing: %w
• no certificate state
• notImplemented
• no pki.key path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/d7b797ce58cee59d. Report an issue: GitHub.