slackhq/nebula · error

error while signing with PKCS#11: %w

Error message

error while signing with PKCS#11: %w

What it means

Wraps a failure from t.SignWith(nil, curve, p11Client.SignASN1) when signing the CA certificate through the PKCS#11 token in `nebula-cert ca`. The public key was fetched fine, but the HSM refused or failed the ASN.1 signature operation. The pkclient error is preserved via %w.

Source

Thrown at cmd/nebula-cert/ca.go:331

	if !isP11 && !isStdio(*cf.outKeyPath) {
		if _, err := os.Stat(*cf.outKeyPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA key: %s", *cf.outKeyPath)
		}
	}

	if !isStdio(*cf.outCertPath) {
		if _, err := os.Stat(*cf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
		}
	}

	var c cert.Certificate
	var b []byte

	if isP11 {
		c, err = t.SignWith(nil, curve, p11Client.SignASN1)
		if err != nil {
			return fmt.Errorf("error while signing with PKCS#11: %w", err)
		}
	} else {
		c, err = t.Sign(nil, curve, rawPriv)
		if err != nil {
			return fmt.Errorf("error while signing: %s", err)
		}

		if *cf.encryption {
			b, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)
			if err != nil {
				return fmt.Errorf("error while encrypting out-key: %s", err)
			}
		} else {
			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
		}

		err = writeOutput(*cf.outKeyPath, b, 0600, out)
		if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the wrapped pkclient error for the PKCS#11 return code (CKR_*)
2. Confirm the key object has signing enabled (CKA_SIGN=true) and the PIN/session is valid
3. Re-run with a correct pin in the -p11url; re-authenticate the token
4. Verify the token stays connected and the PKCS#11 module works (test with pkcs11-tool --sign)

Example fix

// before
nebula-cert ca -p11url "pkcs11:token=mytoken;object=ca-key" -name "my ca"
// after
nebula-cert ca -p11url "pkcs11:token=mytoken;object=ca-key?pin=<pin>" -name "my ca"  # key must have CKA_SIGN=true

// before running: confirm the key supports signing
// pkcs11-tool --module <module> -O   # check CKA_SIGN=true on the key object

func isP11SigningErr(err error) bool {
	return err != nil && strings.Contains(err.Error(), "error while signing with PKCS#11")
}

out, err := exec.Command("nebula-cert", "ca", "-p11url", url, ...).CombinedOutput()
if err != nil && strings.Contains(string(out), "error while signing with PKCS#11") {
	log.Printf("HSM signing failed: %s — check pin, CKA_SIGN flag, session", out)
	return fmt.Errorf("HSM sign failure: %s", out)
}

When it happens

Trigger: nebula-cert ca -p11url ... where SignASN1 fails: wrong/missing PIN for the private key object, key is extract-only restricted or usage flags disallow signing, token removed mid-operation, or session died after GetPubKey.

Common situations: HSM key has CKA_SIGN=false; token locked after bad PIN; PKCS#11 module crashed or session timed out; HSM in a state where private-key operations are denied (e.g. FIPS policy mismatch).

Related errors

• error while getting public key with PKCS#11: %w
• use of Curve25519 is not allowed in FIPS 140-only mode
• notImplemented
• error while creating PKCS#11 client: %w
• error while signing: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/55657c5e05d5fb8d. Report an issue: GitHub.