What causes "no pki.ca path or PEM data provided" in slackhq/nebula?

Set pki.ca to the CA bundle path or inline PEM ('-----BEGIN CERTIFICATE-----') signed by nebula-ca.

no pki.ca path or PEM data provided

Error message

no pki.ca path or PEM data provided

What it means

loadCAPoolFromConfig builds the CA trust pool from the 'pki.ca' setting. If the string is empty there is no CA material to load, so it fails immediately. Every certificate chain must verify against a CA, so this is required config.

Source

Thrown at pki.go:543

	if c.Expired(time.Now()) {
		return nil, b, fmt.Errorf("nebula certificate for this host is expired")
	}

	if len(c.Networks()) == 0 {
		return nil, b, fmt.Errorf("no networks encoded in certificate")
	}

	if c.IsCA() {
		return nil, b, fmt.Errorf("host certificate is a CA certificate")
	}

	return c, b, nil
}

func loadCAPoolFromConfig(l *slog.Logger, c *config.C) (*cert.CAPool, error) {
	caPathOrPEM := c.GetString("pki.ca", "")
	if caPathOrPEM == "" {
		return nil, errors.New("no pki.ca path or PEM data provided")
	}

	var caReader io.ReadCloser
	var err error

	if strings.Contains(caPathOrPEM, "-----BEGIN") {
		caReader = io.NopCloser(strings.NewReader(caPathOrPEM))
	} else {
		caReader, err = os.Open(caPathOrPEM)
		if err != nil {
			return nil, fmt.Errorf("unable to read pki.ca file %s: %s", caPathOrPEM, err)
		}
	}
	defer caReader.Close()

	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
	if errors.Is(err, cert.ErrExpired) {
		var expired int

View on GitHub (pinned to dd8f660c0a)

Solutions

Set pki.ca to the CA bundle path or inline PEM ('-----BEGIN CERTIFICATE-----') signed by nebula-ca.
Verify the ca.crt exists at the configured path and is readable.
Check that the value isn't an empty env expansion when templating.

Example fix

// before
pki:
  cert: /etc/nebula/host.crt
  key: /etc/nebula/host.key
// after
pki:
  cert: /etc/nebula/host.crt
  key: /etc/nebula/host.key
  ca: /etc/nebula/ca.crt

Defensive patterns

Strategy: validation

Validate before calling

if c.GetString("pki.ca", "") == "" {
    return errors.New("config is missing pki.ca: set the CA bundle path or inline PEM")
}

Try / catch

if err := reloadCAPool(l, c); err != nil {
    if strings.Contains(err.Error(), "no pki.ca") {
        log.Fatal("nebula config has no pki.ca set")
    }
}

Prevention

Always provision ca.crt alongside host.crt/key and reference it in config
Validate the trio (cert/key/ca) in a preflight config check
Keep the CA on stable storage; don't rely on env-injected values that can be empty

When it happens

Trigger: reloadCAPool → loadCAPoolFromConfig where c.GetString("pki.ca", "") is "" — pki.ca missing or empty in config.

Common situations: Config template omits the CA entry; ca.crt never provisioned to the host; env variable holding the CA path unset; key renamed in a customized config (e.g. pki.ca_path).

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/91c7db374a632411. Report an issue: GitHub.