slackhq/nebula · error

refusing to overwrite existing cert: %s

Error message

refusing to overwrite existing cert: %s

What it means

nebula-cert sign refuses to clobber an existing output certificate file. Before writing, it stats -out-cert (unless output is stdio); if the file exists (os.Stat succeeds) it returns this error instead of overwriting. This protects signed certs from accidental destruction.

Source

Thrown at cmd/nebula-cert/sign.go:301

		pub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)
		if err != nil {
			return fmt.Errorf("error while parsing in-pub: %s", err)
		}
		if pubCurve != curve {
			return fmt.Errorf("curve of in-pub does not match ca")
		}
	} else if isP11 {
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key with PKCS#11: %w", err)
		}
	} else {
		pub, rawPriv = newKeypair(curve)
	}

	if !isStdio(*sf.outCertPath) {
		if _, err := os.Stat(*sf.outCertPath); err == nil {
			return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
		}
	}

	var crts []cert.Certificate

	notBefore := time.Now()
	notAfter := notBefore.Add(*sf.duration)

	switch version {
	case cert.Version1:
		// Make sure we have only one ipv4 address
		if len(v4Networks) != 1 {
			return newHelpErrorf("invalid -networks definition: v1 certificates can only have a single ipv4 address")
		}

		if len(v6Networks) > 0 {
			return newHelpErrorf("invalid -networks definition: v1 certificates can only contain ipv4 addresses")
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Delete or rename the existing file (or point -out-cert at a new path) and rerun
2. If intentional overwrite is desired, remove the file first: `rm host.crt` before signing
3. Use stdio output (e.g. -out-cert /dev/stdout style stdio handling) if you stream output instead of writing to a path

Example fix

// before (script re-run fails)
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-cert host.crt -out-key host.key
// after
rm -f host.crt host.key
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-cert host.crt -out-key host.key

# shell: fail early if the cert output already exists
if [ -e "$OUT_CERT" ] && [ "$(readlink -f "$OUT_CERT")" != /dev/stdout ]; then
  echo "refusing: $OUT_CERT exists"; exit 1
fi
nebula-cert sign -ca ca.pem -out-cert "$OUT_CERT" -out-key "$OUT_KEY" ...

if err := runSignCmd(); err != nil {
    if strings.Contains(err.Error(), "refusing to overwrite existing cert") {
        // choose a new out-cert path or archive/remove the old file
    }
    return err
}

When it happens

Trigger: Running `nebula-cert sign -out-cert host.crt ...` when host.crt already exists on disk and output is not stdio.

Common situations: Re-running a provisioning script that already issued the cert; reusing a template command without cleaning the output dir; a previous partial run left the file in place.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

• refusing to overwrite existing key: %s
• no certificate state
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided
• no certificates found in pki.cert

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c427417e85d0b5b4. Report an issue: GitHub.