Sentry: signal_unix.go:917: runtime error: invalid memory address or nil pointer dereference (1) attached stack trace -- stack trace: | runtime.sigpanic | GOROOT/src/runtime/signal_unix.go:917 ...

This issue was auto filed by Sentry. It represents a crash or reported error on a live cluster with telemetry enabled.

Sentry Link: [https://cockroach-labs.sentry.io/issues/7601028007/?referrer=webhooks_plugin](https://cockroach-labs.sentry.io/issues/7601028007/?referrer=webhooks_plugin)

Panic Message:

```
signal_unix.go:917: runtime error: invalid memory address or nil pointer dereference
(1) attached stack trace
-- stack trace:
| runtime.sigpanic
| GOROOT/src/runtime/signal_unix.go:917
| math/big.addMulVVW
| src/math/big/arith_amd64.s:443
| math/big.nat.montgomery
| GOROOT/src/math/big/nat.go:223
| math/big.nat.expNNMontgomery
| GOROOT/src/math/big/nat.go:1258
| math/big.nat.expNN
| GOROOT/src/math/big/nat.go:983
| math/big.nat.probablyPrimeMillerRabin
| GOROOT/src/math/big/prime.go:106
| math/big.(*Int).ProbablyPrime
| GOROOT/src/math/big/prime.go:78
| crypto/rand.Prime
| GOROOT/src/crypto/rand/util.go:55
| crypto/rsa.GenerateMultiPrimeKey
| GOROOT/src/crypto/rsa/rsa.go:395
| crypto/rsa.GenerateKey
| GOROOT/src/crypto/rsa/rsa.go:275
| github.com/cockroachdb/cockroach/pkg/security.CreateNodePair
| pkg/security/certs.go:276
| github.com/cockroachdb/cockroach/pkg/cli.runCreateNodeCert
| cert.go:130
| github.com/cockroachdb/cockroach/pkg/cli.init.MaybeDecorateError.func37
| pkg/cli/clierrorplus/decorate_error.go:67
| github.com/spf13/cobra.(*Command).execute
| external/com_github_spf13_cobra/command.go:916
| github.com/spf13/cobra.(*Command).ExecuteC
| external/com_github_spf13_cobra/command.go:1044
| github.com/spf13/cobra.(*Command).Execute
| external/com_github_spf13_cobra/command.go:968
| github.com/cockroachdb/cockroach/pkg/cli.Run
| cli.go:301
| github.com/cockroachdb/cockroach/pkg/cli.doMain
| cli.go:140
| github.com/cockroachdb/cockroach/pkg/cli.Main
| cli.go:65
| main.main
| pkg/cmd/cockroach/main.go:21
| runtime.main
| GOROOT/src/runtime/proc.go:272
| runtime.goexit
| src/runtime/asm_amd64.s:1700
Wraps: (2) runtime error: invalid memory address or nil pointer dereference
Error types: (1) *withstack.withStack (2) runtime.errorString
-- report composition:
runtime.errorString
signal_unix.go:917: *withstack.withStack (top exception)
```

Stacktrace (expand for inline code snippets):

[src/runtime/asm_amd64.s#L1699-L1701](src/runtime/asm_amd64.s#L1699-L1701)
[GOROOT/src/runtime/proc.go#L271-L273](GOROOT/src/runtime/proc.go#L271-L273)
[pkg/cmd/cockroach/main.go#L20-L22](pkg/cmd/cockroach/main.go#L20-L22)
[cli.go#L64-L66](cli.go#L64-L66)
[cli.go#L139-L141](cli.go#L139-L141)
[cli.go#L300-L302](cli.go#L300-L302)
[external/com_github_spf13_cobra/command.go#L967-L969](external/com_github_spf13_cobra/command.go#L967-L969)
[external/com_github_spf13_cobra/command.go#L1043-L1045](external/com_github_spf13_cobra/command.go#L1043-L1045)
[external/com_github_spf13_cobra/command.go#L915-L917](external/com_github_spf13_cobra/command.go#L915-L917)
[pkg/cli/clierrorplus/decorate_error.go#L66-L68](pkg/cli/clierrorplus/decorate_error.go#L66-L68)
[cert.go#L129-L131](cert.go#L129-L131)
[pkg/security/certs.go#L275-L277](pkg/security/certs.go#L275-L277)
[GOROOT/src/crypto/rsa/rsa.go#L274-L276](GOROOT/src/crypto/rsa/rsa.go#L274-L276)
[GOROOT/src/crypto/rsa/rsa.go#L394-L396](GOROOT/src/crypto/rsa/rsa.go#L394-L396)
[GOROOT/src/crypto/rand/util.go#L54-L56](GOROOT/src/crypto/rand/util.go#L54-L56)
[GOROOT/src/math/big/prime.go#L77-L79](GOROOT/src/math/big/prime.go#L77-L79)
[GOROOT/src/math/big/prime.go#L105-L107](GOROOT/src/math/big/prime.go#L105-L107)
[GOROOT/src/math/big/nat.go#L982-L984](GOROOT/src/math/big/nat.go#L982-L984)
[GOROOT/src/math/big/nat.go#L1257-L1259](GOROOT/src/math/big/nat.go#L1257-L1259)
[GOROOT/src/math/big/nat.go#L222-L224](GOROOT/src/math/big/nat.go#L222-L224)
[src/math/big/arith_amd64.s#L442-L444](src/math/big/arith_amd64.s#L442-L444)
[GOROOT/src/runtime/signal_unix.go#L916-L918](GOROOT/src/runtime/signal_unix.go#L916-L918)

```
src/runtime/asm_amd64.s in runtime.goexit at line 1700
GOROOT/src/runtime/proc.go in runtime.main at line 272
pkg/cmd/cockroach/main.go in main.main at line 21
cli.go in pkg/cli.Main at line 65
cli.go in pkg/cli.doMain at line 140
cli.go in pkg/cli.Run at line 301
external/com_github_spf13_cobra/command.go in github.com/spf13/cobra.(*Command).Execute at line 968
external/com_github_spf13_cobra/command.go in github.com/spf13/cobra.(*Command).ExecuteC at line 1044
external/com_github_spf13_cobra/command.go in github.com/spf13/cobra.(*Command).execute at line 916
pkg/cli/clierrorplus/decorate_error.go in pkg/cli.init.MaybeDecorateError.func37 at line 67
cert.go in pkg/cli.runCreateNodeCert at line 130
pkg/security/certs.go in pkg/security.CreateNodePair at line 276
GOROOT/src/crypto/rsa/rsa.go in crypto/rsa.GenerateKey at line 275
GOROOT/src/crypto/rsa/rsa.go in crypto/rsa.GenerateMultiPrimeKey at line 395
GOROOT/src/crypto/rand/util.go in crypto/rand.Prime at line 55
GOROOT/src/math/big/prime.go in math/big.(*Int).ProbablyPrime at line 78
GOROOT/src/math/big/prime.go in math/big.nat.probablyPrimeMillerRabin at line 106
GOROOT/src/math/big/nat.go in math/big.nat.expNN at line 983
GOROOT/src/math/big/nat.go in math/big.nat.expNNMontgomery at line 1258
GOROOT/src/math/big/nat.go in math/big.nat.montgomery at line 223
src/math/big/arith_amd64.s in math/big.addMulVVW at line 443
GOROOT/src/runtime/signal_unix.go in runtime.sigpanic at line 917
```

### Tags

| Tag | Value |
| --- | --- |
| Command | cert create-node |
| Environment | v25.4.10 |
| Go Version | go1.23.12 X:nocoverageredesign |
| Platform | linux amd64 |
| Distribution | CCL |
| Cockroach Release | v25.4.10 |
| Cockroach SHA | a1989021dd825212349c067edcd07a77597c0781 |
| # of CPUs | 8 |
| # of Goroutines | 9 |

Jira issue: CRDB-65615

Start at pkg/security/certs.go:276 in CreateNodePair and pkg/cli/cert.go:130 in runCreateNodeCert, then compare the v25.4.10 Go 1.23.12 Linux amd64 environment from the report. Reproduce the cert create-node command if possible and trace the RSA key-generation failure through the reported stack. Done means the command no longer panics and the underlying failure has a verified handling or fix.

Written by the indexing model from the issue text.