What causes "error while writing out-crt: %s" in slackhq/nebula?

Verify the -out-crt path's parent directory exists and is writable.

error while writing out-crt: %s

Error message

error while writing out-crt: %s

What it means

nebula-cert's `ca` subcommand failed while writing the generated CA certificate PEM to the path given via the -out-crt flag. Marshalling succeeded but writeOutput to disk (or stdout) failed; the underlying error is embedded in the message.

Source

Thrown at cmd/nebula-cert/ca.go:361

			}
		} else {
			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
		}

		err = writeOutput(*cf.outKeyPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	b, err = c.MarshalPEM()
	if err != nil {
		return fmt.Errorf("error while marshalling certificate: %s", err)
	}

	err = writeOutput(*cf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *cf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*cf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func caSummary() string {

View on GitHub (pinned to dd8f660c0a)

Solutions

Verify the -out-crt path's parent directory exists and is writable.
Ensure the -out-crt path does not point at an existing directory.
Check available disk space (df -h).
Run from a writable directory or supply an absolute writable path.

Example fix

// before
nebula-cert ca -name org -out-crt /etc/nebula
// after (path must be a file, not a dir)
nebula-cert ca -name org -out-crt /etc/nebula/ca.crt

Defensive patterns

Strategy: try-catch

Validate before calling

#!/bin/sh
CRT_PATH="$OUT_CRT_PATH"
[ -d "$CRT_PATH" ] && { echo "$CRT_PATH is a directory" >&2; exit 1; }
[ -w "$(dirname "$CRT_PATH")" ] || { echo "dir not writable" >&2; exit 1; }

Try / catch

err = writeOutput(*cf.outCertPath, b, 0600, out)
if err != nil {
    return fmt.Errorf("error while writing out-crt: %s", err)
}

Prevention

Point -out-crt at a file, never a directory.
Pre-create and permission the output directory.
Monitor free disk space in CI runners.
Use absolute paths in automation.

When it happens

Trigger: Running `nebula-cert ca` where writeOutput(*cf.outCertPath, b, 0600, out) fails: missing parent directory, permission denied, disk full, or path is a directory.

Common situations: Typo in -out-crt path; read-only filesystem or container; -out-crt pointing at an existing directory; out of disk space after generating a large key.

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/b81a78db39e271f1. Report an issue: GitHub.