use of Curve25519 is not allowed in FIPS 140-only mode

Error message

use of Curve25519 is not allowed in FIPS 140-only mode

What it means

In cmd/nebula-cert/sign.go (signCert), after curve selection (including PKCS#11 paths) the code rejects cert.Curve_CURVE25519 whenever fips140.Enforced() is true. Signing a node certificate with a non-FIPS-approved curve is refused to keep the whole PKI FIPS-compliant.

Source

Thrown at cmd/nebula-cert/sign.go:273

		}
	}

	var pub, rawPriv []byte
	var p11Client *pkclient.PKClient

	if isP11 {
		curve = cert.Curve_P256
		p11Client, err = pkclient.FromUrl(*sf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
	}

	if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
		return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
	}

	if *sf.inPubPath != "" {
		var pubCurve cert.Curve
		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
		if err != nil {
			return fmt.Errorf("error while reading in-pub: %s", err)
		}

		pub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)
		if err != nil {
			return fmt.Errorf("error while parsing in-pub: %s", err)
		}
		if pubCurve != curve {
			return fmt.Errorf("curve of in-pub does not match ca")
		}
	} else if isP11 {
		pub, err = p11Client.GetPubKey()

View on GitHub (pinned to dd8f660c0a)

Solutions

Sign with -curve P256 (and rekey nodes with P256 keys).
Rebuild or reconfigure the environment without fips140=only if 25519 must be used.
Migrate the PKI: generate a P256 CA and re-issue all node certificates.
Use a PKCS#11 client bound to a FIPS-validated module with P256 keys.

Example fix

// before
$ nebula-cert sign -curve 25519 -in-pub node.pub ...

// after
$ nebula-cert sign -curve P256 -in-pub node.pub ...

Defensive patterns

Strategy: validation

Validate before calling

if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
    return errors.New("sign: P256 required under FIPS 140-only mode")
}
// proceed with nebula-cert sign

Type guard

func signableUnderFIPS(c cert.Curve) bool {
    return c != cert.Curve_CURVE25519
}

Try / catch

out, err := exec.Command("nebula-cert", "sign", args...).CombinedOutput()
if err != nil && strings.Contains(string(out), "FIPS 140-only") {
    return rekeyAndSignWithP256()
}

Prevention

Plan the PKI around P256 where FIPS compliance is required.
Inventory existing node keys and rekey any 25519 nodes before FIPS rollout.
Run signing pipelines against a FIPS-enforced canary first.
Keep CA and node curves consistent; mixed-curve PKIs will fail at sign time.

When it happens

Trigger: Running 'nebula-cert sign -curve 25519...' (or signing with a 25519 CA/public key) while FIPS 140-only enforcement is active; sign.go:273 checks fips140.Enforced() && curve == cert.Curve_CURVE25519.

Common situations: Signing existing 25519 node keys on newly FIPS-hardened hosts; mixed fleets where legacy certs are 25519 and new signing hosts enforce FIPS.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/98d3e41a5584e281. Report an issue: GitHub.