slackhq/nebula · error

failed to decode issuer: %w

Error message

failed to decode issuer: %w

What it means

When marshalling certificate details, the Issuer field (if set) must be a hex-encoded string; it is hex-decoded so the raw bytes can be embedded in the ASN.1 structure. If hex.DecodeString fails, this error is returned. It means the Issuer string contains non-hex characters or odd length.

Source

Thrown at cert/cert_v2.go:554

		// Add IsCA only if true
		if d.isCA {
			b.AddASN1(TagDetailsIsCA, func(b *cryptobyte.Builder) {
				b.AddUint8(0xff)
			})
		}

		// Add not before
		b.AddASN1Int64WithTag(d.notBefore.Unix(), TagDetailsNotBefore)

		// Add not after
		b.AddASN1Int64WithTag(d.notAfter.Unix(), TagDetailsNotAfter)

		// Add the issuer if present
		if d.issuer != "" {
			issuerBytes, innerErr := hex.DecodeString(d.issuer)
			if innerErr != nil {
				err = fmt.Errorf("failed to decode issuer: %w", innerErr)
				return
			}
			b.AddASN1(TagDetailsIssuer, func(b *cryptobyte.Builder) {
				b.AddBytes(issuerBytes)
			})
		}
	})

	if err != nil {
		return nil, err
	}

	return b.Bytes()
}

func unmarshalCertificateV2(b []byte, publicKey []byte, curve Curve) (*certificateV2, error) {
	l := len(b)
	if l == 0 || l > MaxCertificateSize {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Set the issuer using hex.EncodeToString of the signing certificate's raw bytes.
2. Strip non-hex characters (colons, whitespace) from any issuer string before assigning it.
3. Validate with hex.DecodeString yourself before building the certificate to fail early.

Example fix

// before
certDetails.Issuer = string(signingCert.Raw()) // not hex
// after
certDetails.Issuer = hex.EncodeToString(signingCert.Raw())

if details.Issuer != "" {
    if _, err := hex.DecodeString(details.Issuer); err != nil {
        return fmt.Errorf("issuer %q is not valid hex: %w", details.Issuer, err)
    }
}

func isHexString(s string) bool {
    _, err := hex.DecodeString(s)
    return err == nil && len(s)%2 == 0
}

if err != nil && strings.Contains(err.Error(), "failed to decode issuer") {
    return fmt.Errorf("issuer must be hex-encoded raw certificate bytes: %w", err)
}

When it happens

Trigger: Creating or signing a certificate whose details.issuer is set to a non-hex string (e.g. a raw fingerprint with separators, base64, or the full certificate text instead of hex of the issuer certificate's raw bytes).

Common situations: Setting Issuer = issuerCert.Details.Name or some human-readable ID instead of hex.EncodeToString(issuerRaw); copying a fingerprint formatted with colons; storing issuer via JSON round-trip that altered the string.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• no issuer in certificate
• marshalling certificate details failed: %w
• unable to marshal network: %w
• unable to marshal unsafe network: %w
• ErrBadFormat

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c11f2a2a9f3afa36. Report an issue: GitHub.