slackhq/nebula · error

refusing to overwrite existing CA cert: %s

Error message

refusing to overwrite existing CA cert: %s

What it means

Safety guard in `nebula-cert ca`: if -out-cert-path already exists on disk (and is not stdio) the command aborts rather than replacing an existing CA certificate. Even when a new key is fine, silently swapping a CA cert would invalidate trust chains built on the old cert.

Source

Thrown at cmd/nebula-cert/ca.go:321

		Groups:         groups,
		Networks:       networks,
		UnsafeNetworks: unsafeNetworks,
		NotBefore:      time.Now(),
		NotAfter:       time.Now().Add(*cf.duration),
		PublicKey:      pub,
		IsCA:           true,
		Curve:          curve,
	}

	if !isP11 && !isStdio(*cf.outKeyPath) {
		if _, err := os.Stat(*cf.outKeyPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA key: %s", *cf.outKeyPath)
		}
	}

	if !isStdio(*cf.outCertPath) {
		if _, err := os.Stat(*cf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
		}
	}

	var c cert.Certificate
	var b []byte

	if isP11 {
		c, err = t.SignWith(nil, curve, p11Client.SignASN1)
		if err != nil {
			return fmt.Errorf("error while signing with PKCS#11: %w", err)
		}
	} else {
		c, err = t.Sign(nil, curve, rawPriv)
		if err != nil {
			return fmt.Errorf("error while signing: %s", err)
		}

		if *cf.encryption {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Move/rename or delete the existing CA cert if replacement is intended
2. Supply a different -out-cert-path for the new CA
3. Write the cert to stdout via stdio path and redirect as needed
4. If renewing, use the sign/renew workflows rather than generating a new CA over the old cert

Example fix

// before
nebula-cert ca -name "my ca"   # fails: ca.crt exists
// after
mv ca.crt ca.crt.old && nebula-cert ca -name "my ca"

if _, err := os.Stat(outCertPath); err == nil {
	return fmt.Errorf("cert %s exists; move it or choose another path", outCertPath)
}

When it happens

Trigger: nebula-cert ca with -out-cert-path pointing to an existing certificate file; re-running ca against the same directory, or a previous run already produced ca.crt.

Common situations: Re-running ca in automation; existing default ca.crt in the working directory; a previous successful or partial run left the cert behind; user intends to renew but does not realize the command never overwrites.

Related errors

• refusing to overwrite existing CA key: %s
• error while writing out-key: %s
• error while writing out-crt: %s
• error while writing out-qr: %s
• error while writing out-key: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/4cd4d65d7de5a90c. Report an issue: GitHub.