slackhq/nebula · critical

no certificates found in pki.cert

Error message

no certificates found in pki.cert

What it means

newCertStateFromConfig parses the pki.cert data (supporting v1 and v2 nebula certificates). If neither a v1 nor a v2 certificate could be parsed out of the provided data, this error is returned. Unlike error 101, the pki.cert setting was non-empty but its contents yielded no certificates.

Source

Thrown at pki.go:365

				return nil, fmt.Errorf("v1 certificate already found in pki.cert")
			}
			v1 = crt
		case cert.Version2:
			if v2 != nil {
				return nil, fmt.Errorf("v2 certificate already found in pki.cert")
			}
			v2 = crt
		default:
			return nil, fmt.Errorf("unknown certificate version %v", crt.Version())
		}

		if len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == "" {
			break
		}
	}

	if v1 == nil && v2 == nil {
		return nil, errors.New("no certificates found in pki.cert")
	}

	useInitiatingVersion := uint32(1)
	if v1 == nil {
		// The only condition that requires v2 as the default is if only a v2 certificate is present
		// We do this to avoid having to configure it specifically in the config file
		useInitiatingVersion = 2
	}

	rawInitiatingVersion := c.GetUint32("pki.initiating_version", useInitiatingVersion)
	var initiatingVersion cert.Version
	switch rawInitiatingVersion {
	case 1:
		if v1 == nil {
			return nil, fmt.Errorf("can not use pki.initiating_version 1 without a v1 certificate in pki.cert")
		}
		initiatingVersion = cert.Version1
	case 2:

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Inspect the file at pki.cert and confirm it contains a valid PEM block ('-----BEGIN CERTIFICATE-----' ... '-----END CERTIFICATE-----') and is non-empty.
2. Re-copy or re-issue the certificate with nebula-cert (nebula-cert print can validate it).
3. Ensure pki.cert points to the host certificate, not the key or CA file.

Example fix

// before
pki:
  cert: /etc/nebula/host.key   # wrong file
// after
pki:
  cert: /etc/nebula/host.crt   # contains BEGIN CERTIFICATE block

data, err := os.ReadFile(certPath)
if err != nil || !bytes.Contains(data, []byte("-----BEGIN CERTIFICATE-----")) {
    return fmt.Errorf("%s does not contain a PEM certificate", certPath)
}

if err := reloadCerts(); err != nil {
    if strings.Contains(err.Error(), "no certificates found in pki.cert") {
        log.Fatalf("pki.cert (%s) contains no valid certificates", certPath)
    }
}

When it happens

Trigger: pki.cert points to a file or inline data that parses to zero certificates: empty/truncated file, garbage or wrong-format data (e.g. a private key, a JSON blob), or only whitespace after PEM stripping.

Common situations: Cert file accidentally truncated or zero bytes after a failed copy; pointing pki.cert at the key file or CA file by mistake; cert generated by an incompatible tool; newline/BOM corruption from a bad editor or secret manager.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no certificate state
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided
• no pki.ca path or PEM data provided
• no valid CA certificates present

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/4b64fdb842e9a91c. Report an issue: GitHub.