refusing to sign, root certificate does not match private ke

Error message

refusing to sign, root certificate does not match private key

What it means

Fatal refusal in signCert: caCert.VerifyPrivateKey(curve, caKey) failed, meaning the supplied CA signing key does not pair with the CA certificate (wrong key, wrong curve, or mismatched keypair). Signing is deliberately aborted rather than producing a certificate no peer will trust; the underlying cause is dropped from the message.

Source

Thrown at cmd/nebula-cert/sign.go:188

			}
		} else if err != nil {
			return fmt.Errorf("error while parsing ca-key: %s", err)
		}
	}

	rawCACert, err := readInput("ca-crt", *sf.caCertPath, &claims)
	if err != nil {
		return fmt.Errorf("error while reading ca-crt: %s", err)
	}

	caCert, _, err := cert.UnmarshalCertificateFromPEM(rawCACert)
	if err != nil {
		return fmt.Errorf("error while parsing ca-crt: %s", err)
	}

	if !isP11 {
		if err := caCert.VerifyPrivateKey(curve, caKey); err != nil {
			return fmt.Errorf("refusing to sign, root certificate does not match private key")
		}
	}

	if caCert.Expired(time.Now()) {
		return fmt.Errorf("ca certificate is expired")
	}

	if version == 0 {
		version = caCert.Version()
	}

	// if no duration is given, expire one second before the root expires
	if *sf.duration <= 0 {
		*sf.duration = time.Until(caCert.NotAfter()) - time.Second*1
	}

	if *sf.networks != "" {
		for _, rs := range strings.Split(*sf.networks, ",") {

View on GitHub (pinned to dd8f660c0a)

Solutions

Use the private key that matches the CA certificate
Re-check that ca-key and ca-crt came from the same nebula-cert ca invocation
If the key is on PKCS#11, verify the p11 URL points to the right key slot

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at cmd/nebula-cert/sign.go:188 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/4a537b7861d452c2. Report an issue: GitHub.