What causes "error while writing out-key: %s" in slackhq/nebula?

Check that the directory named by -out-key exists and is writable by the current user (mkdir -p / chmod).

error while writing out-key: %s

Error message

error while writing out-key: %s

What it means

nebula-cert's `ca` subcommand failed while writing the generated CA private key to the path given via the -out-key flag. The key PEM was already produced (or generated by PKCS#11), but writing it to disk or stdout failed. The underlying OS/library error is embedded in the message.

Source

Thrown at cmd/nebula-cert/ca.go:350

		}
	} else {
		c, err = t.Sign(nil, curve, rawPriv)
		if err != nil {
			return fmt.Errorf("error while signing: %s", err)
		}

		if *cf.encryption {
			b, err = cert.EncryptAndMarshalSigningPrivateKey(curve, rawPriv, passphrase, kdfParams)
			if err != nil {
				return fmt.Errorf("error while encrypting out-key: %s", err)
			}
		} else {
			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
		}

		err = writeOutput(*cf.outKeyPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	b, err = c.MarshalPEM()
	if err != nil {
		return fmt.Errorf("error while marshalling certificate: %s", err)
	}

	err = writeOutput(*cf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *cf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

Check that the directory named by -out-key exists and is writable by the current user (mkdir -p / chmod).
Run nebula-cert from a writable working directory or use an absolute -out-key path.
Re-run with elevated permissions only if the target location truly requires it.
Inspect the embedded underlying error in the message for the exact OS reason.

Example fix

// before
nebula-cert ca -name org -out-key /etc/nebula/ca.key
// after (directory may not exist)
mkdir -p /etc/nebula && nebula-cert ca -name org -out-key /etc/nebula/ca.key

Defensive patterns

Strategy: try-catch

Validate before calling

#!/bin/sh
KEY_DIR=$(dirname "$OUT_KEY_PATH")
[ -d "$KEY_DIR" ] || mkdir -p "$KEY_DIR"
[ -w "$KEY_DIR" ] || { echo "cannot write $KEY_DIR" >&2; exit 1; }

Try / catch

if err := writeOutput(outKeyPath, b, 0600, out); err != nil {
    return fmt.Errorf("error while writing out-key: %s", err)
}
// caller: inspect the wrapped error to distinguish permission vs missing dir

Prevention

Create the output directory before running nebula-cert.
Run as a user with write access to the target directory.
Use absolute paths in scripts and CI.
Check disk space and mount flags (rw) in containers.

When it happens

Trigger: Running `nebula-cert ca` where writeOutput(*cf.outKeyPath, b, 0600, out) fails: the -out-key path's parent directory does not exist, the process lacks write permission, or the file cannot be created.

Common situations: Typo in -out-key path; running in a read-only container or CI working directory; non-root user writing to a root-owned directory; SELinux/AppArmor denying file creation.

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/9223a0a8eb10de6c. Report an issue: GitHub.