{"record":{"id":"af242f67e80161e4","repo":"slackhq/nebula","slug":"unknown-certificate-version-v","errorCode":null,"errorMessage":"unknown certificate version %v","messagePattern":"unknown certificate version (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":356,"sourceCode":"\t\t}\n\n\t\tif fips140.Enforced() && crt.Curve() != cert.Curve_P256 {\n\t\t\treturn nil, fmt.Errorf(\"pki: use of %s is not allowed in FIPS 140-only mode\", crt.Curve())\n\t\t}\n\n\t\tswitch crt.Version() {\n\t\tcase cert.Version1:\n\t\t\tif v1 != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"v1 certificate already found in pki.cert\")\n\t\t\t}\n\t\t\tv1 = crt\n\t\tcase cert.Version2:\n\t\t\tif v2 != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"v2 certificate already found in pki.cert\")\n\t\t\t}\n\t\t\tv2 = crt\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unknown certificate version %v\", crt.Version())\n\t\t}\n\n\t\tif len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == \"\" {\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif v1 == nil && v2 == nil {\n\t\treturn nil, errors.New(\"no certificates found in pki.cert\")\n\t}\n\n\tuseInitiatingVersion := uint32(1)\n\tif v1 == nil {\n\t\t// The only condition that requires v2 as the default is if only a v2 certificate is present\n\t\t// We do this to avoid having to configure it specifically in the config file\n\t\tuseInitiatingVersion = 2\n\t}\n","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L338-L374","documentation":"While scanning the certificates in pki.cert, newCertStateFromConfig hit a certificate whose version is neither Version1 nor Version2. The loaded cert library does not recognize the version, so it refuses to build cert state.","triggerScenarios":"newCertStateFromConfig (via reloadCerts) encounters a certificate returned by cert.UnmarshalCertificate whose Version() is not 1 or 2 — e.g. a corrupted, truncated, or future-version certificate inside pki.cert.","commonSituations":"pki.cert corrupted by partial write/truncation; a certificate produced by a newer nebula version than the binary supports; a foreign/wrong PEM blob pasted into pki.cert.","solutions":["Replace pki.cert with a freshly generated/valid nebula certificate","Upgrade the nebula binary so it supports the certificate version in the file","Validate the certificate: nebula-cert print -path pki.cert"],"exampleFix":"// before\n# pki.cert contains a cert from a newer nebula (unsupported version)\n// after\nnebula-cert ca -name 'my ca'   # and re-issue the host cert with the supported version\nnebula-cert sign -ca-crt ca.crt -ca-key ca.key -name host1 -ip 10.0.0.1/24","handlingStrategy":"validation","validationCode":"// pre-flight parse of every cert in pki.cert\nfunc validateCertVersions(pkiCertPEM []byte) error {\n    rest := pkiCertPEM\n    for len(rest) > 0 {\n        crt, r, err := cert.UnmarshalCertificate(rest)\n        if err != nil { return fmt.Errorf(\"unparsable cert in pki.cert: %w\", err) }\n        if v := crt.Version(); v != cert.Version1 && v != cert.Version2 {\n            return fmt.Errorf(\"unsupported cert version: %v\", v)\n        }\n        rest = r\n    }\n    return nil\n}","typeGuard":"func isKnownVersion(c cert.Certificate) bool {\n    return c.Version() == cert.Version1 || c.Version() == cert.Version2\n}","tryCatchPattern":null,"preventionTips":["Keep the nebula binary version in sync with the tooling that issues certificates","Never hand-edit PEM files; regenerate with nebula-cert","Validate pki.cert at deploy time with nebula-cert print"],"tags":["pki","certificate","version"],"backgroundTag":"unsupported-certificate-version","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}