What causes "error while writing out-key: %s" in slackhq/nebula?

Check that the directory of -out-key exists and is writable by the running user (mkdir -p / chmod)

error while writing out-key: %s

Error message

error while writing out-key: %s

What it means

After successfully signing, the freshly generated private key is written with writeOutput(-out-key, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600). If writing fails (I/O error, permissions, marshal failure), this wrapped error is returned. Note the certificate was already signed at this point, but the key never reaches disk.

Source

Thrown at cmd/nebula-cert/sign.go:395

			}
		}

		crts = append(crts, nc)
	default:
		// this should be unreachable
		return fmt.Errorf("invalid version: %d", version)
	}

	if !isP11 && *sf.inPubPath == "" {
		if !isStdio(*sf.outKeyPath) {
			if _, err := os.Stat(*sf.outKeyPath); err == nil {
				return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
			}
		}

		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	var b []byte
	for _, c := range crts {
		sb, err := c.MarshalPEM()
		if err != nil {
			return fmt.Errorf("error while marshalling certificate: %s", err)
		}
		b = append(b, sb...)
	}

	err = writeOutput(*sf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *sf.outQRPath != "" {

View on GitHub (pinned to dd8f660c0a)

Solutions

Check that the directory of -out-key exists and is writable by the running user (mkdir -p / chmod)
Free disk space or resolve quota issues if the disk is full
Check the wrapped inner error for permission denied vs marshal failure; ensure output is not blocked by MAC policies (SELinux/AppArmor)

Example fix

// before
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key /etc/nebula/missing-dir/host.key -out-cert host.crt
// after
mkdir -p /etc/nebula
ebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key /etc/nebula/host.key -out-cert /etc/nebula/host.crt

Defensive patterns

Strategy: validation

Validate before calling

# shell: verify output dir is writable before signing
KEY_DIR=$(dirname "$OUT_KEY")
mkdir -p "$KEY_DIR" && [ -w "$KEY_DIR" ] || { echo "cannot write $KEY_DIR"; exit 1; }
df -h "$KEY_DIR" | awk 'NR==2 && $5+0 > 95 {print "disk nearly full"; exit 1}'

Try / catch

if err := runSignCmd(); err != nil {
    if strings.Contains(err.Error(), "error while writing out-key") {
        // cert may have been signed but key write failed; fix path/permissions, re-run cleanly
    }
    return err
}

Prevention

Provision output directories with correct ownership/permissions before running sign
Monitor disk space and quotas on hosts performing batch issuance
Run as a user with write access to the key store; check SELinux/AppArmor denials in audit logs

When it happens

Trigger: writeOutput failing while persisting the new private key: unwritable directory, full disk, permission denied on the target path, or MarshalPrivateKeyToPEM failing for the curve.

Common situations: -out-key pointing at a read-only or nonexistent directory; running without write permission on the path; disk quota/full volume; SELinux/AppArmor blocking file creation.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/a832c9bfe5c7dc26. Report an issue: GitHub.