slackhq/nebula · critical

no certificate state

Error message

no certificate state

What it means

Configuration guard in NewInterface: InterfaceConfig.pki is nil, meaning no certificate/PKI state was built (e.g. pki config missing or failed to load). The interface cannot handshake or encrypt without certificates, so construction aborts.

Source

Thrown at interface.go:192

		return "always"
	case recvErrorNever:
		return "never"
	case recvErrorPrivate:
		return "private"
	default:
		return fmt.Sprintf("invalid(%d)", s)
	}
}

func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
	if c.Outside == nil {
		return nil, errors.New("no outside connection")
	}
	if c.Inside == nil {
		return nil, errors.New("no inside interface (tun)")
	}
	if c.pki == nil {
		return nil, errors.New("no certificate state")
	}
	if c.Firewall == nil {
		return nil, errors.New("no firewall rules")
	}
	if c.connectionManager == nil {
		return nil, errors.New("no connection manager")
	}

	if c.routines <= 1 {
		c.PinThreads = false //pinning is not useful unless there's more than one tun reader
	}

	cs := c.pki.getCertState()
	ifce := &Interface{
		ctx:                   ctx,
		pki:                   c.pki,
		hostMap:               c.HostMap,
		outside:               c.Outside,

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Verify pki.cert, pki.key and pki.ca paths in config point to valid, readable files
2. Check earlier logs for certificate parse/load errors
3. Regenerate or reissue expired/invalid certificates with nebula-cert
4. Ensure the pki section is present and correctly structured in the config

if cfg.InterfaceConfig.Pki == nil {
    return errors.New("pki not loaded; check cert/key/ca paths")
}
// also verify upfront:
_, err := pki.NewPKIFromConfig(cfg.Pki) // fails fast on bad cert paths/parse errors

i, err := NewInterface(ctx, c)
if err != nil {
    if err.Error() == "no certificate state" { /* fix pki config / regenerate certs */ }
    return err
}

When it happens

Trigger: InterfaceConfig.pki is nil because certificate loading (ca pool + own cert/key) failed or was skipped in Main before interface creation.

Common situations: Bad cert/key file paths in config; unparseable or expired certificates; missing 'pki' config section; YAML/JSON struct not mapped when embedding nebula.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no outside connection
• no inside interface (tun)
• no firewall rules
• no connection manager
• no pki.key path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/72794fa2e6a086e5. Report an issue: GitHub.