What causes "no networks encoded in certificate" in slackhq/nebula?

Reissue the host cert including its VPN address, e.g. 'nebula-cert sign ... -ip 10.0.0.5/24'

no networks encoded in certificate

Error message

no networks encoded in certificate

What it means

loadCertificate requires the host certificate to encode at least one network (VPN IP/CIDR). If c.Networks() is empty the certificate carries no address, which would leave the node without a tunnel IP, so startup fails with this error.

Source

Thrown at pki.go:530

			return nil, curve, false, fmt.Errorf("error while unmarshaling pki.key %s: %s", privPathOrPEM, err)
		}
	}

	return
}

func loadCertificate(b []byte) (cert.Certificate, []byte, error) {
	c, b, err := cert.UnmarshalCertificateFromPEM(b)
	if err != nil {
		return nil, b, fmt.Errorf("error while unmarshaling pki.cert: %w", err)
	}

	if c.Expired(time.Now()) {
		return nil, b, fmt.Errorf("nebula certificate for this host is expired")
	}

	if len(c.Networks()) == 0 {
		return nil, b, fmt.Errorf("no networks encoded in certificate")
	}

	if c.IsCA() {
		return nil, b, fmt.Errorf("host certificate is a CA certificate")
	}

	return c, b, nil
}

func loadCAPoolFromConfig(l *slog.Logger, c *config.C) (*cert.CAPool, error) {
	caPathOrPEM := c.GetString("pki.ca", "")
	if caPathOrPEM == "" {
		return nil, errors.New("no pki.ca path or PEM data provided")
	}

	var caReader io.ReadCloser
	var err error

View on GitHub (pinned to dd8f660c0a)

Solutions

Reissue the host cert including its VPN address, e.g. 'nebula-cert sign ... -ip 10.0.0.5/24'
Inspect the existing cert with 'nebula-cert print' to confirm networks are absent
Ensure config tun.dev/tunnel ranges match the network encoded in the new cert

Example fix

// before
nebula-cert sign -ca-cpath ca.crt -ca-kpath ca.key -name host   # no -ip
// after
nebula-cert sign -ca-cpath ca.crt -ca-kpath ca.key -name host -ip 10.0.0.5/24

Defensive patterns

Strategy: validation

Validate before calling

c, _, err := cert.UnmarshalCertificateFromPEM(certBytes)
if err == nil && len(c.Networks()) == 0 {
    return fmt.Errorf("cert has no networks; reissue with -ip")
}

Type guard

func certHasNetworks(c cert.Certificate) bool { return len(c.Networks()) > 0 }

Try / catch

if err := startNebula(); err != nil && strings.Contains(err.Error(), "no networks encoded") {
    return fmt.Errorf("reissue host cert with an -ip argument: %w", err)
}

Prevention

Always pass -ip/-cidr when signing host certs
Inspect certs with 'nebula-cert print' in CI before rollout
Avoid hand-generated certificates; use nebula-cert workflows

When it happens

Trigger: newCertStateFromConfig parses a valid, unexpired certificate that simply has no networks encoded — typically a cert signed without an -ip/-cidr argument.

Common situations: Hand-edited or programmatically generated cert missing networks; signing with a tool/version that omits networks; using a CA or sub-package cert not intended as a host identity.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/1d0344dbd8d53ed4. Report an issue: GitHub.