slackhq/nebula · critical

no pki.cert path or PEM data provided

Error message

no pki.cert path or PEM data provided

What it means

After loading the private key, newCertStateFromConfig reads 'pki.cert'. If that string is empty the node has no public certificate to present, so it returns this error. pki.cert must be either a file path or inline PEM containing the certificate.

Source

Thrown at pki.go:318

func newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) {
	var err error

	privPathOrPEM := c.GetString("pki.key", "")
	if privPathOrPEM == "" {
		return nil, errors.New("no pki.key path or PEM data provided")
	}

	rawKey, curve, isPkcs11, err := loadPrivateKey(privPathOrPEM)
	if err != nil {
		return nil, err
	}

	var rawCert []byte

	pubPathOrPEM := c.GetString("pki.cert", "")
	if pubPathOrPEM == "" {
		return nil, errors.New("no pki.cert path or PEM data provided")
	}

	if strings.Contains(pubPathOrPEM, "-----BEGIN") {
		rawCert = []byte(pubPathOrPEM)
		pubPathOrPEM = "<inline>"

	} else {
		rawCert, err = os.ReadFile(pubPathOrPEM)
		if err != nil {
			return nil, fmt.Errorf("unable to read pki.cert file %s: %s", pubPathOrPEM, err)
		}
	}

	var crt, v1, v2 cert.Certificate
	for {
		// Load the certificate
		crt, rawCert, err = loadCertificate(rawCert)
		if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Set pki.cert in the config to the certificate path or inline PEM ('-----BEGIN CERTIFICATE-----').
2. Confirm the cert file exists at the configured path and is readable (path errors here come later, so an empty string usually means the setting itself is missing).
3. Ensure the value is non-empty even when using inline PEM — an empty env-expanded variable (e.g. $NEBULA_CERT unset) yields this error.

Example fix

// before
pki:
  key: /etc/nebula/host.key
// after
pki:
  key: /etc/nebula/host.key
  cert: /etc/nebula/host.crt

if c.GetString("pki.cert", "") == "" {
    return errors.New("config is missing pki.cert: set a cert file path or inline PEM")
}

if err := reloadCerts(); err != nil {
    if strings.Contains(err.Error(), "no pki.cert") {
        log.Fatal("nebula config has no pki.cert set")
    }
}

When it happens

Trigger: reloadCerts → newCertStateFromConfig with config where c.GetString("pki.cert", "") is "" — pki.cert absent or empty in the config.

Common situations: Config template only defines pki.key; cert file path renamed/moved without updating config; provisioning system failed to copy the certificate; typo like pki.certificate instead of pki.cert.

Related errors

• no certificate state
• no pki.key path or PEM data provided
• no pki.ca path or PEM data provided
• no outside connection
• no inside interface (tun)

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/16e3685584e9d508. Report an issue: GitHub.