slackhq/nebula · critical

no pki.key path or PEM data provided

Error message

no pki.key path or PEM data provided

What it means

newCertStateFromConfig builds the node's certificate state from the pki config section. Before any key loading happens it reads the 'pki.key' setting; if that string is empty there is nothing to parse, so it returns this error immediately. It means the nebula config lacks any private key, either as a file path or inline PEM.

Source

Thrown at pki.go:306

	}

	if cs.v2Cert != nil {
		b, err := cs.v2Cert.MarshalJSON()
		if err != nil {
			return nil, err
		}
		msg = append(msg, b)
	}

	return json.Marshal(msg)
}

func newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) {
	var err error

	privPathOrPEM := c.GetString("pki.key", "")
	if privPathOrPEM == "" {
		return nil, errors.New("no pki.key path or PEM data provided")
	}

	rawKey, curve, isPkcs11, err := loadPrivateKey(privPathOrPEM)
	if err != nil {
		return nil, err
	}

	var rawCert []byte

	pubPathOrPEM := c.GetString("pki.cert", "")
	if pubPathOrPEM == "" {
		return nil, errors.New("no pki.cert path or PEM data provided")
	}

	if strings.Contains(pubPathOrPEM, "-----BEGIN") {
		rawCert = []byte(pubPathOrPEM)
		pubPathOrPEM = "<inline>"

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Set pki.key in the config to the path of the private key file (e.g. /etc/nebula/host.key) or to inline PEM beginning '-----BEGIN ... PRIVATE KEY-----'.
2. Verify the YAML structure nests key/cert/ca under pki: and that no empty-string value overrides it.
3. If building config in code, call c.SetString("pki.key", ...) before invoking Start/reloadCerts.

Example fix

// before
pki:
  cert: /etc/nebula/host.crt
// after
pki:
  cert: /etc/nebula/host.crt
  key: /etc/nebula/host.key

if c.GetString("pki.key", "") == "" {
    return errors.New("config is missing pki.key: set a key file path or inline PEM")
}

if err := reloadCerts(); err != nil {
    if strings.Contains(err.Error(), "no pki.key") {
        log.Fatal("nebula config has no pki.key set; cannot start")
    }
}

When it happens

Trigger: Calling reloadCerts/newCertStateFromConfig with a config.C where c.GetString("pki.key", "") returns "" — i.e. the config has no pki.key entry at all, or it is set to an empty string.

Common situations: Fresh config templates missing the pki block; YAML key typo (pki: key: mis-indented so it isn't under pki); config generated programmatically without setting pki.key; key section stripped when templating configs.

Related errors

• no certificate state
• no pki.cert path or PEM data provided
• no pki.ca path or PEM data provided
• no outside connection
• no inside interface (tun)

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/2b6b659842c6ae5d. Report an issue: GitHub.