{"record":{"id":"9d4b30a2fc61a62b","repo":"slackhq/nebula","slug":"unknown-pki-initiating-version-v","errorCode":null,"errorMessage":"unknown pki.initiating_version: %v","messagePattern":"unknown pki\\.initiating_version: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":386,"sourceCode":"\tuseInitiatingVersion := uint32(1)\n\tif v1 == nil {\n\t\t// The only condition that requires v2 as the default is if only a v2 certificate is present\n\t\t// We do this to avoid having to configure it specifically in the config file\n\t\tuseInitiatingVersion = 2\n\t}\n\n\trawInitiatingVersion := c.GetUint32(\"pki.initiating_version\", useInitiatingVersion)\n\tvar initiatingVersion cert.Version\n\tswitch rawInitiatingVersion {\n\tcase 1:\n\t\tif v1 == nil {\n\t\t\treturn nil, fmt.Errorf(\"can not use pki.initiating_version 1 without a v1 certificate in pki.cert\")\n\t\t}\n\t\tinitiatingVersion = cert.Version1\n\tcase 2:\n\t\tinitiatingVersion = cert.Version2\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown pki.initiating_version: %v\", rawInitiatingVersion)\n\t}\n\n\treturn newCertState(initiatingVersion, v1, v2, isPkcs11, curve, rawKey, cipher)\n}\n\nfunc newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte, cipher string) (*CertState, error) {\n\tcs := CertState{\n\t\tprivateKey:               privateKey,\n\t\tpkcs11Backed:             pkcs11backed,\n\t\tcipher:                   cipher,\n\t\tmyVpnNetworksTable:       new(bart.Lite),\n\t\tmyVpnAddrsTable:          new(bart.Lite),\n\t\tmyVpnBroadcastAddrsTable: new(bart.Lite),\n\t}\n\n\tif v1 != nil && v2 != nil {\n\t\tif !slices.Equal(v1.PublicKey(), v2.PublicKey()) {\n\t\t\treturn nil, util.NewContextualError(\"v1 and v2 public keys are not the same, ignoring\", nil, nil)","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L368-L404","documentation":"Validation error in newCertStateFromConfig: pki.initiating_version was set to a value other than 1 or 2, so the switch on the configured uint32 matched no case. (Values 1 and 2 are handled explicitly, including the guard requiring a v1 cert for version 1.)","triggerScenarios":"newCertStateFromConfig (via reloadCerts) reads pki.initiating_version with a value other than 1 or 2 (e.g. 0, 3, or a non-numeric string resolved to 0).","commonSituations":"Typo in config (initiating_version: 12 or 2.0); YAML value parsed as 0; copied config from an unsupported docs page.","solutions":["Set pki.initiating_version to exactly 1 or 2","Remove the key entirely to use the default behavior","Quote-check the YAML so it parses as an integer"],"exampleFix":"// before\npki:\n  initiating_version: 3\n// after\npki:\n  initiating_version: 2","handlingStrategy":"validation","validationCode":"// validate config before load\nfunc validInitiatingVersion(v uint32) bool { return v == 1 || v == 2 }\n// usage: if !validInitiatingVersion(cfg.GetUint32(\"pki.initiating_version\", 2)) { reject config }","typeGuard":"func isInitiatingVersion(v uint32) bool { return v == 1 || v == 2 }","tryCatchPattern":null,"preventionTips":["Restrict the config value to 1 or 2 in config schema validation","Avoid strings/floats in YAML that coerce to unexpected integers","Lint nebula configs against known pki.* keys before deploy"],"tags":["pki","config","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}