What causes "error while writing out-crt: %s" in slackhq/nebula?

Verify the -out-crt path's parent directory exists and is writable

error while writing out-crt: %s

Error message

error while writing out-crt: %s

What it means

After successfully signing and PEM-marshalling the certificate(s), signCert writes the concatenated PEM bytes to the -out-crt path via writeOutput. When writeOutput fails (unwritable path, bad directory, permission denied), the error is wrapped as 'error while writing out-crt'.

Source

Thrown at cmd/nebula-cert/sign.go:410

		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	var b []byte
	for _, c := range crts {
		sb, err := c.MarshalPEM()
		if err != nil {
			return fmt.Errorf("error while marshalling certificate: %s", err)
		}
		b = append(b, sb...)
	}

	err = writeOutput(*sf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *sf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*sf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func newKeypair(curve cert.Curve) ([]byte, []byte) {

View on GitHub (pinned to dd8f660c0a)

Solutions

Verify the -out-crt path's parent directory exists and is writable
Run with corrected permissions or a different output location
If writing to stdout ('-'), ensure stdout is connected and writable

Example fix

// before
./nebula-cert sign -ca ca.pem -key ca.key -name host -out-crt /nonexistent/host.crt
// after
mkdir -p /etc/nebula && ./nebula-cert sign -ca ca.pem -key ca.key -name host -out-crt /etc/nebula/host.crt

Defensive patterns

Strategy: validation

Validate before calling

import "os"
if dir := filepath.Dir(outPath); !isWritableDir(dir) {
    return fmt.Errorf("cannot write cert to %s", outPath)
}
func isWritableDir(d string) bool {
    fi, err := os.Stat(d)
    return err == nil && fi.IsDir()
}

Try / catch

if err := cmd.Run(); err != nil {
    if strings.Contains(err.Error(), "error while writing out-crt") {
        log.Printf("check -out-crt path: %v", err)
    }
}

Prevention

Pre-create the output directory (mkdir -p) before signing
Use absolute paths in scripts
Avoid writing certs to read-only mounts

When it happens

Trigger: writeOutput(*sf.outCertPath, b, 0600, out) returns an error — typically because outCertPath points to a non-existent directory, is not writable, or the underlying writer (stdout) errored.

Common situations: Typo in the -out-crt path; parent directory does not exist; read-only filesystem; no write permission; writing to stdout when stdout is a closed pipe.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/dd8ad258ba376c21. Report an issue: GitHub.