What causes "unable to read cert; %s" in slackhq/nebula?

Verify the file exists at the -path value (ls -l)

unable to read cert; %s

Error message

unable to read cert; %s

What it means

printCert reads the certificate file (or stdin in stdio mode) via readInput("path", *pf.path, &claims); any failure is wrapped as "unable to read cert". It means the -path argument could not be resolved to bytes: file missing, unreadable, empty, or stdin unavailable. The underlying OS/reader error is appended after the semicolon.

Source

Thrown at cmd/nebula-cert/print.go:53

	if err != nil {
		return err
	}

	if err := mustFlagString("path", pf.path); err != nil {
		return err
	}

	var claims ioClaims
	if err := reserveInputs(&claims, "path", *pf.path); err != nil {
		return err
	}
	if err := reserveOutputs(&claims, "out-qr", *pf.outQRPath); err != nil {
		return err
	}

	rawCert, err := readInput("path", *pf.path, &claims)
	if err != nil {
		return fmt.Errorf("unable to read cert; %s", err)
	}

	// When the QR is going to stdout, suppress the human-readable text/json
	// output so the binary stream is not contaminated.
	qrToStdout := isStdio(*pf.outQRPath)

	var c cert.Certificate
	var qrBytes []byte
	part := 0

	var jsonCerts []cert.Certificate

	for {
		c, rawCert, err = cert.UnmarshalCertificateFromPEM(rawCert)
		if err != nil {
			return fmt.Errorf("error while unmarshaling cert: %s", err)
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

Verify the file exists at the -path value (ls -l)
Check read permissions on the certificate file
If using stdio mode, confirm the PEM is actually piped into stdin
Use an absolute path instead of a relative one
Re-export/regenerate the certificate if the file is empty or truncated

Example fix

// before
nebula-cert print -path ./crt.crt   # file is actually at ./certs/crt.crt
// after
nebula-cert print -path ./certs/crt.crt

Defensive patterns

Strategy: validation

Validate before calling

st, err := os.Stat(*pf.path)
if err != nil { return fmt.Errorf("cert file missing: %w", err) }
if st.IsDir() || st.Size() == 0 { return fmt.Errorf("cert file %q is empty", *pf.path) }
if f, err := os.Open(*pf.path); err == nil { f.Close() }

Try / catch

if err := printCert(args, out, errOut); err != nil {
    if strings.HasPrefix(err.Error(), "unable to read cert") {
        log.Fatalf("check -path %q exists and is readable: %v", *pf.path, err)
    }
}

Prevention

Verify the -path value with ls before running
Use absolute paths in scripts
When relying on stdin/stdio, confirm the PEM is actually piped in
Mount/copy the cert into containers before invoking print

When it happens

Trigger: `nebula-cert print -path /some/cert.crt` where the file does not exist, lacks read permission, is empty, or the stdio/stdin input mode fails (e.g. no piped input when -path is omitted and stdio requested)

Common situations: wrong path passed to -path; typo in filename; running print without piping input while relying on stdin; container images missing the mounted cert; permissions after switching users

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ab73822b41ea587f. Report an issue: GitHub.