slackhq/nebula · error

refusing to overwrite existing CA key

Error message

refusing to overwrite existing CA key: %s

What it means

Safety guard in `nebula-cert ca`: before writing the new CA private key, os.Stat checks -out-key-path and if the file already exists (and the target is not stdio and PKCS#11 is not in use) the command aborts instead of clobbering an existing CA key. Destroying an old CA key would orphan every cert it signed, so overwrite is refused.

Solutions

1. Move or delete the existing key file only if you truly intend to retire the CA
2. Choose a new -out-key-path for the new CA
3. Write to stdout (-out-key-path with '-' / stdio) if you redirect yourself
4. If the file is a stale partial from a failed run, remove it after confirming it is not a live CA key

Example fix

// before
nebula-cert ca -name "my ca"   # fails: ca.key exists
// after
mv ca.key ca.key.old && nebula-cert ca -name "my ca"

if _, err := os.Stat(outKeyPath); err == nil {
	return fmt.Errorf("key %s exists; move it or choose another path", outKeyPath)
}

When it happens

Trigger: nebula-cert ca with -out-key-path pointing to an existing file; e.g. re-running the same ca command twice, or a previous failed run left a partial key file on disk.

Common situations: Idempotent re-runs in CI/automation; leftover key from an earlier aborted run; wrong working directory causing an existing key path to be hit; confusion with -out-key-path defaulting to ca.key in cwd.

Related errors

• refusing to overwrite existing CA cert
• error while writing out-crt
• error while writing out-crt
• error while writing out-key
• error while writing out-key

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e5a77df48cd645a3. Report an issue: GitHub.

Appendix: source

Thrown at cmd/nebula-cert/ca.go:315

		}
	}

	t := &cert.TBSCertificate{
		Version:        version,
		Name:           *cf.name,
		Groups:         groups,
		Networks:       networks,
		UnsafeNetworks: unsafeNetworks,
		NotBefore:      time.Now(),
		NotAfter:       time.Now().Add(*cf.duration),
		PublicKey:      pub,
		IsCA:           true,
		Curve:          curve,
	}

	if !isP11 && !isStdio(*cf.outKeyPath) {
		if _, err := os.Stat(*cf.outKeyPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA key: %s", *cf.outKeyPath)
		}
	}

	if !isStdio(*cf.outCertPath) {
		if _, err := os.Stat(*cf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
		}
	}

	var c cert.Certificate
	var b []byte

	if isP11 {
		c, err = t.SignWith(nil, curve, p11Client.SignASN1)
		if err != nil {
			return fmt.Errorf("error while signing with PKCS#11: %w", err)
		}
	} else {

View on GitHub (pinned to dd8f660c0a)