slackhq/nebula · error

error while unmarshaling cert: %s

Error message

error while unmarshaling cert: %s

What it means

printCert loops calling cert.UnmarshalCertificateFromPEM on the remaining raw bytes; a parse failure is wrapped as "error while unmarshaling cert". It means the input bytes were read but are not a valid Nebula PEM certificate (bad PEM framing or corrupted/unsupported certificate body). The loop also allows a bundle of concatenated certs, and it fails on the first invalid one.

Source

Thrown at cmd/nebula-cert/print.go:69

	rawCert, err := readInput("path", *pf.path, &claims)
	if err != nil {
		return fmt.Errorf("unable to read cert; %s", err)
	}

	// When the QR is going to stdout, suppress the human-readable text/json
	// output so the binary stream is not contaminated.
	qrToStdout := isStdio(*pf.outQRPath)

	var c cert.Certificate
	var qrBytes []byte
	part := 0

	var jsonCerts []cert.Certificate

	for {
		c, rawCert, err = cert.UnmarshalCertificateFromPEM(rawCert)
		if err != nil {
			return fmt.Errorf("error while unmarshaling cert: %s", err)
		}

		if !qrToStdout {
			if *pf.json {
				jsonCerts = append(jsonCerts, c)
			} else {
				_, _ = out.Write([]byte(c.String()))
				_, _ = out.Write([]byte("\n"))
			}
		}

		if *pf.outQRPath != "" {
			b, err := c.MarshalPEM()
			if err != nil {
				return fmt.Errorf("error while marshalling cert to PEM: %s", err)
			}
			qrBytes = append(qrBytes, b...)
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Confirm the input is a certificate PEM (starts with -----BEGIN NEBULA ... CERTIFICATE-----), not a key
2. Re-copy the certificate ensuring the full PEM including BEGIN/END lines is intact
3. Check binary/version compatibility: upgrade nebula-cert if the cert was issued by a newer format
4. Regenerate the certificate with `nebula-cert ca`/`sign` if the file is corrupted

Example fix

// before
nebula-cert print -path ./host.key      # this is a private key
// after
nebula-cert print -path ./host.crt

data, err := os.ReadFile(path)
if err != nil { return err }
if !strings.Contains(string(data), "-----BEGIN") || !strings.Contains(string(data), "CERTIFICATE-----") {
    return fmt.Errorf("%s does not look like a certificate PEM", path)
}

func looksLikeCertPEM(data []byte) bool {
    return strings.Contains(string(data), "-----BEGIN") && strings.Contains(string(data), "CERTIFICATE-----")
}

if err := printCert(args, out, errOut); err != nil {
    if strings.Contains(err.Error(), "error while unmarshaling cert") {
        log.Fatalf("input is not a valid Nebula certificate PEM: %v", err)
    }
}

When it happens

Trigger: `nebula-cert print -path f` where f contains a private key, a truncated PEM, HTML/text instead of PEM, or a PEM of a different type (e.g. a CA key instead of a cert); passing an encrypted or foreign-format certificate the parser can't decode

Common situations: accidentally printing the .key file instead of the .crt; a cert downloaded/copy-pasted with mangled whitespace or missing BEGIN/END lines; certs issued by a newer format/version not supported by the installed nebula-cert

Related errors

• ErrTruncatedPEMBlock
• ErrBadFormat
• input did not contain a valid PEM encoded block
• input did not contain a valid PEM encoded block
• error while marshalling certificate: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/2414bd4b99498a6d. Report an issue: GitHub.