slackhq/nebula · error

invalid version: %d

Error message

invalid version: %d

What it means

After the Version1/Version2 switch in signCert, the default branch returns this error for any unrecognized certificate version. The code comments it should be unreachable: version is set from flags/CA parsing upstream, so hitting it indicates a version value outside the known enum or a CA cert of a newer/unknown version.

Source

Thrown at cmd/nebula-cert/sign.go:383

		}

		var nc cert.Certificate
		if p11Client == nil {
			nc, err = t.Sign(caCert, curve, caKey)
			if err != nil {
				return fmt.Errorf("error while signing: %w", err)
			}
		} else {
			nc, err = t.SignWith(caCert, curve, p11Client.SignASN1)
			if err != nil {
				return fmt.Errorf("error while signing with PKCS#11: %w", err)
			}
		}

		crts = append(crts, nc)
	default:
		// this should be unreachable
		return fmt.Errorf("invalid version: %d", version)
	}

	if !isP11 && *sf.inPubPath == "" {
		if !isStdio(*sf.outKeyPath) {
			if _, err := os.Stat(*sf.outKeyPath); err == nil {
				return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
			}
		}

		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}

	var b []byte
	for _, c := range crts {
		sb, err := c.MarshalPEM()

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the CA cert version with `nebula-cert print -path ca.pem`; regenerate the CA with a supported version (v1/v2) using the same nebula version
2. Ensure the -version flag (if used) is 1 or 2
3. Upgrade or reinstall nebula-cert so the CA version is recognized

Example fix

// before
nebula-cert sign -ca new-ca.pem ...  # CA from newer build, unknown version
// after
nebula-cert ca -name 'new ca' -version 2 ...   # regenerate a supported CA
nebula-cert sign -ca ca.pem -version 2 ...

# shell: only accept known CA versions before signing
v=$(nebula-cert print -path ca.pem | grep -i 'certificate version' | tr -dc '0-9')
[ "$v" = "1" ] || [ "$v" = "2" ] || { echo "unsupported CA version: $v"; exit 1; }

if err := runSignCmd(); err != nil {
    if strings.Contains(err.Error(), "invalid version:") {
        // CA is from an incompatible/newer nebula build; re-mint or upgrade nebula-cert
    }
    return err
}

When it happens

Trigger: signCert invoked with a version that is neither cert.Version1 nor cert.Version2 — practically only possible with a corrupted or future-version CA certificate from which the version was derived, or a bug in flag handling.

Common situations: Signing against a CA generated by a much newer nebula build with an unknown cert version; a corrupted ca.pem whose parsed version is garbage; custom builds with modified version enums.

Related errors

• no certificate state
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided
• no certificates found in pki.cert
• no pki.ca path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/0f5f491c97082a85. Report an issue: GitHub.