slackhq/nebula · error

self signed certificates must have IsCA set to true

Error message

self signed certificates must have IsCA set to true

What it means

When SignWith is called with signer == nil (self-signing), the certificate must have IsCA set to true. A self-signed non-CA certificate would be meaningless in nebula's PKI because only CAs can sign other certs, so the library rejects this combination.

Source

Thrown at cert/sign.go:99

	if signer != nil {
		if t.IsCA {
			return nil, fmt.Errorf("can not sign a CA certificate with another")
		}

		err := checkCAConstraints(signer, t.NotBefore, t.NotAfter, t.Groups, t.Networks, t.UnsafeNetworks)
		if err != nil {
			return nil, err
		}

		issuer, err := signer.Fingerprint()
		if err != nil {
			return nil, fmt.Errorf("error computing issuer: %v", err)
		}
		t.issuer = issuer
	} else {
		if !t.IsCA {
			return nil, fmt.Errorf("self signed certificates must have IsCA set to true")
		}
	}

	var c beingSignedCertificate
	switch t.Version {
	case Version1:
		c = &certificateV1{}
		err := c.fromTBSCertificate(t)
		if err != nil {
			return nil, err
		}
	case Version2:
		c = &certificateV2{}
		err := c.fromTBSCertificate(t)
		if err != nil {
			return nil, err
		}
	default:

View on GitHub (pinned to dd8f660c0a)

Solutions

1. If creating a CA, set t.Details.IsCA = true before calling SignWith with nil signer.
2. If creating a normal host certificate, pass the CA certificate and private key as the signer instead of nil.
3. In the nebula-cert CLI, ensure the -ca flow sets IsCA; check custom code that constructs NebulaCertificateDetails.

Example fix

// before
root, err := cert.Sign(nil, key, t) // t.Details.IsCA == false

// after
t.Details.IsCA = true
root, err := cert.Sign(nil, key, t)

if signer == nil && !t.Details.IsCA {
    return fmt.Errorf("self-signing requires IsCA: true")
}

root, err := cert.Sign(nil, key, t)
if err != nil && strings.Contains(err.Error(), "self signed certificates must have IsCA") {
    // set IsCA or supply a signer
    return err
}

When it happens

Trigger: Calling SignWith(t, nil, key) — i.e. no signer — while t.Details.IsCA is false (or via cert.Sign/standaloneSelfSign paths that skip the signer).

Common situations: Generating a leaf/host certificate but forgetting to supply the CA signer, or generating a root CA but forgetting to set IsCA: true in the certificate details (e.g. the nebula-cert ca command building details without the flag).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no certificates found in pki.cert
• %s: %w
• can not sign a CA certificate with another
• error computing issuer: %v
• unknown cert version %d

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/507155690e0f5452. Report an issue: GitHub.