slackhq/nebula · error

refusing to overwrite existing key: %s

Error message

refusing to overwrite existing key: %s

What it means

Like the cert overwrite check, sign refuses to replace an existing private key file. When a fresh key was generated (no -in-pub, no PKCS#11) and -out-key exists on disk (os.Stat succeeds, non-stdio), the command returns this error rather than silently destroying a private key.

Source

Thrown at cmd/nebula-cert/sign.go:389

				return fmt.Errorf("error while signing: %w", err)
			}
		} else {
			nc, err = t.SignWith(caCert, curve, p11Client.SignASN1)
			if err != nil {
				return fmt.Errorf("error while signing with PKCS#11: %w", err)
			}
		}

		crts = append(crts, nc)
	default:
		// this should be unreachable
		return fmt.Errorf("invalid version: %d", version)
	}

	if !isP11 && *sf.inPubPath == "" {
		if !isStdio(*sf.outKeyPath) {
			if _, err := os.Stat(*sf.outKeyPath); err == nil {
				return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
			}
		}

		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	var b []byte
	for _, c := range crts {
		sb, err := c.MarshalPEM()
		if err != nil {
			return fmt.Errorf("error while marshalling certificate: %s", err)
		}
		b = append(b, sb...)
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Move or delete the existing key file, or choose a new -out-key path, then rerun
2. If the key must be preserved, back it up before regenerating; note deleting it invalidates any cert issued for it
3. Reuse the existing key via -in-pub instead of generating a new one

Example fix

// before
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key host.key -out-cert host.crt  # fails: host.key exists
// after
mv host.key host.key.bak
nebula-cert sign -ca ca.pem -name host -ip 10.0.0.2/24 -out-key host.key -out-cert host.crt

# shell: fail early if the key output already exists
if [ -e "$OUT_KEY" ] && [ "$(readlink -f "$OUT_KEY")" != /dev/stdout ]; then
  echo "refusing: $OUT_KEY exists"; exit 1
fi
nebula-cert sign -ca ca.pem -out-key "$OUT_KEY" -out-cert "$OUT_CERT" ...

if err := runSignCmd(); err != nil {
    if strings.Contains(err.Error(), "refusing to overwrite existing key") {
        // archive or remove the old key, or switch to -in-pub to reuse it
    }
    return err
}

When it happens

Trigger: Running `nebula-cert sign -out-key host.key ...` (with a generated key, i.e. no -in-pub and no -pkcs11) when host.key already exists.

Common situations: Re-running provisioning scripts; leftover key from a prior run; reusing a host name in automation without cleanup; accidentally pointing -out-key at an existing key you must not lose.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

• refusing to overwrite existing cert: %s
• error while writing out-key: %s
• failed to parse private key: %s
• ErrInvalidPrivateKey
• ErrPeerRejected

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e4e30574f4005e88. Report an issue: GitHub.