{"record":{"id":"3a8ac5081d48105c","repo":"slackhq/nebula","slug":"unknown-cert-version-d","errorCode":null,"errorMessage":"unknown cert version %d","messagePattern":"unknown cert version (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/sign.go","lineNumber":118,"sourceCode":"\t\t}\n\t}\n\n\tvar c beingSignedCertificate\n\tswitch t.Version {\n\tcase Version1:\n\t\tc = &certificateV1{}\n\t\terr := c.fromTBSCertificate(t)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tcase Version2:\n\t\tc = &certificateV2{}\n\t\terr := c.fromTBSCertificate(t)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown cert version %d\", t.Version)\n\t}\n\n\tcertBytes, err := c.marshalForSigning()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsig, err := sp(certBytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif curve == Curve_P256 {\n\t\tsig, err = p256.Normalize(sig)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/sign.go#L100-L136","documentation":"SignWith switches on t.Version to build the concrete certificate struct (certificateV1/V2). Any version value other than the known constants (Version1, Version2) falls into the default branch and returns \"unknown cert version\". It is a programmer error: an unsupported or zero-value Version was set on the TBS certificate.","triggerScenarios":"Setting t.Version to an undefined value (e.g. 0, 3, or a value from a newer/older nebula-cert release) before calling SignWith/Sign.","commonSituations":"Hand-constructing NebulaCertificateDetails and forgetting to set Version: 1, cross-version interop where a v2 cert is fed to an older library that only knows v1, or decoding constants from an incompatible release.","solutions":["Set t.Version = cert.Version1 (or cert.Version2 if supported by your library version) before signing.","Upgrade the nebula library if the certificate uses a newer version constant than the linked code knows.","Validate the version right after unmarshaling/constructing the certificate with a switch over known cert.Version constants."],"exampleFix":"// before\nt := &cert.NebulaCertificate{Details: cert.NebulaCertificateDetails{}} // Version zero-value\nroot, err := cert.Sign(nil, key, t)\n\n// after\nt := &cert.NebulaCertificate{Details: cert.NebulaCertificateDetails{Version: cert.Version1}}\nroot, err := cert.Sign(nil, key, t)","handlingStrategy":"validation","validationCode":"switch t.Details.Version {\ncase cert.Version1, cert.Version2:\n    // ok\ndefault:\n    return fmt.Errorf(\"unsupported version %d\", t.Details.Version)\n}","typeGuard":null,"tryCatchPattern":"root, err := cert.Sign(signer, key, t)\nif err != nil && strings.Contains(err.Error(), \"unknown cert version\") {\n    // normalize t.Version to a supported constant\n    return err\n}","preventionTips":["Always initialize Version explicitly (Version1/Version2), never rely on zero values.","Pin the nebula library version and constants your certificates use.","Validate version immediately after unmarshaling external certificates."],"tags":["pki","certificate","versioning"],"backgroundTag":"unsupported-certificate-version","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}