What causes "error while writing out-key: %s" in slackhq/nebula?

Ensure the -out-key parent directory exists and is writable (mkdir -p, chown/chmod).

error while writing out-key: %s

Error message

error while writing out-key: %s

What it means

nebula-cert's key generation failed while writing the generated private key PEM to the path given via -out-key. The keypair (software mode) was created, but writeOutput failed; the underlying OS error is embedded in the message.

Source

Thrown at cmd/nebula-cert/keygen.go:102

		return err
	}

	if isP11 {
		p11Client, err := pkclient.FromUrl(*cf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key: %w", err)
		}
	} else {
		err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}
	err = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-pub: %s", err)
	}

	return nil
}

func keygenSummary() string {
	return "keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`"
}

func keygenHelp(out io.Writer) {
	cf := newKeygenFlags()
	_, _ = out.Write([]byte("Usage of " + os.Args[0] + " " + keygenSummary() + "\n"))
	_, _ = out.Write([]byte(stdioHelpText))

View on GitHub (pinned to dd8f660c0a)

Solutions

Ensure the -out-key parent directory exists and is writable (mkdir -p, chown/chmod).
Provide an absolute writable path or run from a writable directory.
Verify the target is a file path, not a directory.
Check disk space if the filesystem is full.

Example fix

// before
nebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/host.pub
// after
mkdir -p /etc/nebula && nebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/host.pub

Defensive patterns

Strategy: try-catch

Validate before calling

#!/bin/sh
KEY_DIR=$(dirname "$OUT_KEY_PATH")
[ -d "$KEY_DIR" ] || mkdir -p "$KEY_DIR"
[ -w "$KEY_DIR" ] || { echo "cannot write $KEY_DIR" >&2; exit 1; }
[ ! -d "$OUT_KEY_PATH" ] || { echo "$OUT_KEY_PATH is a directory" >&2; exit 1; }

Try / catch

err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
if err != nil {
    return fmt.Errorf("error while writing out-key: %s", err)
}

Prevention

Pre-create the output directory with correct ownership.
Run keygen as a user permitted to write the key location.
Use absolute paths in scripts/CI.
Verify the -out-key target is not a directory.

When it happens

Trigger: Running `nebula-cert keygen -out-key <path>` where writeOutput(*cf.outKeyPath, b, 0600, out) fails: missing parent directory, permission denied, path is a directory, or disk full.

Common situations: Typo in -out-key path; read-only container filesystem or CI workspace; non-root user lacking write permission to /etc/nebula; the -out-key path colliding with an existing directory.

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/0bc7dd6e50d6a049. Report an issue: GitHub.