{"record":{"id":"0f5f491c97082a85","repo":"slackhq/nebula","slug":"invalid-version-d","errorCode":null,"errorMessage":"invalid version: %d","messagePattern":"invalid version: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":383,"sourceCode":"\t\t}\n\n\t\tvar nc cert.Certificate\n\t\tif p11Client == nil {\n\t\t\tnc, err = t.Sign(caCert, curve, caKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing: %w\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tnc, err = t.SignWith(caCert, curve, p11Client.SignASN1)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error while signing with PKCS#11: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tcrts = append(crts, nc)\n\tdefault:\n\t\t// this should be unreachable\n\t\treturn fmt.Errorf(\"invalid version: %d\", version)\n\t}\n\n\tif !isP11 && *sf.inPubPath == \"\" {\n\t\tif !isStdio(*sf.outKeyPath) {\n\t\t\tif _, err := os.Stat(*sf.outKeyPath); err == nil {\n\t\t\t\treturn fmt.Errorf(\"refusing to overwrite existing key: %s\", *sf.outKeyPath)\n\t\t\t}\n\t\t}\n\n\t\terr = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\n\tvar b []byte\n\tfor _, c := range crts {\n\t\tsb, err := c.MarshalPEM()","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L365-L401","documentation":"After the Version1/Version2 switch in signCert, the default branch returns this error for any unrecognized certificate version. The code comments it should be unreachable: version is set from flags/CA parsing upstream, so hitting it indicates a version value outside the known enum or a CA cert of a newer/unknown version.","triggerScenarios":"signCert invoked with a version that is neither cert.Version1 nor cert.Version2 — practically only possible with a corrupted or future-version CA certificate from which the version was derived, or a bug in flag handling.","commonSituations":"Signing against a CA generated by a much newer nebula build with an unknown cert version; a corrupted ca.pem whose parsed version is garbage; custom builds with modified version enums.","solutions":["Check the CA cert version with `nebula-cert print -path ca.pem`; regenerate the CA with a supported version (v1/v2) using the same nebula version","Ensure the -version flag (if used) is 1 or 2","Upgrade or reinstall nebula-cert so the CA version is recognized"],"exampleFix":"// before\nnebula-cert sign -ca new-ca.pem ...  # CA from newer build, unknown version\n// after\nnebula-cert ca -name 'new ca' -version 2 ...   # regenerate a supported CA\nnebula-cert sign -ca ca.pem -version 2 ...","handlingStrategy":"validation","validationCode":"# shell: only accept known CA versions before signing\nv=$(nebula-cert print -path ca.pem | grep -i 'certificate version' | tr -dc '0-9')\n[ \"$v\" = \"1\" ] || [ \"$v\" = \"2\" ] || { echo \"unsupported CA version: $v\"; exit 1; }","typeGuard":null,"tryCatchPattern":"if err := runSignCmd(); err != nil {\n    if strings.Contains(err.Error(), \"invalid version:\") {\n        // CA is from an incompatible/newer nebula build; re-mint or upgrade nebula-cert\n    }\n    return err\n}","preventionTips":["Keep nebula-cert and nebula versions in lockstep across environments","Never hand-edit or truncate ca.pem; validate with nebula-cert print after transfer","Gate CA distribution so only v1/v2 CAs reach signing infrastructure"],"tags":["pki","certificate-version","unreachable","nebula"],"backgroundTag":"unsupported-certificate-version","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}