no passphrase specified, remove -encrypt flag to write out-k

Error message

no passphrase specified, remove -encrypt flag to write out-key in plaintext

What it means

After five failed attempts to capture a passphrase (or an empty one each time), nebula-cert ca refuses to continue: an empty passphrase cannot be used with -encrypt, so it tells the user to drop the -encrypt flag to write the out-key in plaintext instead.

Source

Thrown at cmd/nebula-cert/ca.go:240

		passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
		if len(passphrase) == 0 {
			for i := 0; i < 5; i++ {
				errOut.Write([]byte("Enter passphrase: "))
				passphrase, err = pr.ReadPassword()

				if err == ErrNoTerminal {
					return fmt.Errorf("out-key must be encrypted interactively")
				} else if err != nil {
					return fmt.Errorf("error reading passphrase: %s", err)
				}

				if len(passphrase) > 0 {
					break
				}
			}

			if len(passphrase) == 0 {
				return fmt.Errorf("no passphrase specified, remove -encrypt flag to write out-key in plaintext")
			}
		}
	}

	var curve cert.Curve
	var pub, rawPriv []byte
	var p11Client *pkclient.PKClient

	if isP11 {
		switch *cf.curve {
		case "P256":
			curve = cert.Curve_P256
		default:
			return fmt.Errorf("invalid curve for PKCS#11: %s", *cf.curve)
		}

		p11Client, err = pkclient.FromUrl(*cf.p11url)
		if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

Type a non-empty passphrase at the prompt and confirm it.
Remove the -encrypt flag if you intentionally want a plaintext out-key.
Fix automation scripts that pipe blank lines into the command's stdin.

Example fix

// before (automation feeding blanks)
printf '\n\n\n\n\n' | nebula-cert ca -name "ca" -encrypt

// after
nebula-cert ca -name "ca" -encrypt  # type passphrase interactively
// or drop encryption:
nebula-cert ca -name "ca"

Defensive patterns

Strategy: validation

Try / catch

out, err := exec.Command("nebula-cert", "ca", "-encrypt", ...).CombinedOutput()
if err != nil && strings.Contains(string(out), "no passphrase specified") {
    // supply a non-empty passphrase or drop -encrypt
    return err
}

Prevention

Always enter a non-empty passphrase when -encrypt is set.
Do not script -encrypt with piped/blank input.
Remove -encrypt when a plaintext key is intended.

When it happens

Trigger: Running `nebula-cert ca -encrypt` and pressing Enter (empty input) five consecutive times at the "Enter passphrase:" prompt.

Common situations: Users unaware a passphrase is mandatory, accidental Enter presses, or automated input feeding blank lines into the prompt.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/5d0095ab9f2ec428. Report an issue: GitHub.