slackhq/nebula · error

no issuer in certificate

Error message

no issuer in certificate

What it means

GetCAForCert looks up the signing CA by the certificate's Issuer field. The library throws "no issuer in certificate" when the certificate has an empty issuer, meaning it cannot even attempt the CA lookup. This happens for self-signed/root certificates, which have no issuer recorded (or an issuer that is not the empty string only in the CA map sense).

Source

Thrown at cert/ca_pool.go:257

	}
	if !c.CheckSignature(signer.Certificate.PublicKey()) {
		return nil, ErrSignatureMismatch
	}

	err = CheckCAConstraints(signer.Certificate, c)
	if err != nil {
		return nil, err
	}

	return signer, nil
}

// GetCAForCert attempts to return the signing certificate for the provided certificate.
// No signature validation is performed
func (ncp *CAPool) GetCAForCert(c Certificate) (*CachedCertificate, error) {
	issuer := c.Issuer()
	if issuer == "" {
		return nil, fmt.Errorf("no issuer in certificate")
	}

	signer, ok := ncp.CAs[issuer]
	if ok {
		return signer, nil
	}

	return nil, ErrCaNotFound
}

// GetFingerprints returns an array of trusted CA fingerprints
func (ncp *CAPool) GetFingerprints() []string {
	fp := make([]string, len(ncp.CAs))

	i := 0
	for k := range ncp.CAs {
		fp[i] = k
		i++

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Only pass leaf/intermediate certificates (non-empty Issuer) to GetCAForCert/VerifyCertificate
2. Check c.Issuer() != "" before calling
3. For self-signed certs, compare fingerprints against the pool's CA entries directly instead
4. Regenerate the certificate ensuring the issuer field is set by the signing tool

Example fix

// before
signer, err := pool.GetCAForCert(cert) // panics into error for self-signed cert
// after
if cert.Issuer() == "" {
    return nil, fmt.Errorf("certificate is self-signed; no CA lookup possible")
}
signer, err := pool.GetCAForCert(cert)

if cert.Issuer() == "" {
    // self-signed or root cert; skip CA lookup
    return nil
}
signer, err := pool.GetCAForCert(cert)

When it happens

Trigger: Calling CAPool.GetCAForCert(c) with a root/CA certificate whose Issuer() returns ""; also reached indirectly via CAPool.VerifyCertificate/verify when a root CA certificate is passed in as the certificate being verified.

Common situations: Accidentally adding a root CA to the pool as a host cert and then verifying it; calling GetCAForCert on a self-signed certificate generated for testing; parsing an incomplete certificate where the issuer field was never populated.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to decode issuer: %w
• ErrBadFormat
• ErrRootExpired
• ErrExpired
• ErrNotCA

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c04a7dc9217a02a3. Report an issue: GitHub.