slackhq/nebula · error

unknown cert version %d

Error message

unknown cert version %d

What it means

SignWith switches on t.Version to build the concrete certificate struct (certificateV1/V2). Any version value other than the known constants (Version1, Version2) falls into the default branch and returns "unknown cert version". It is a programmer error: an unsupported or zero-value Version was set on the TBS certificate.

Source

Thrown at cert/sign.go:118

		}
	}

	var c beingSignedCertificate
	switch t.Version {
	case Version1:
		c = &certificateV1{}
		err := c.fromTBSCertificate(t)
		if err != nil {
			return nil, err
		}
	case Version2:
		c = &certificateV2{}
		err := c.fromTBSCertificate(t)
		if err != nil {
			return nil, err
		}
	default:
		return nil, fmt.Errorf("unknown cert version %d", t.Version)
	}

	certBytes, err := c.marshalForSigning()
	if err != nil {
		return nil, err
	}

	sig, err := sp(certBytes)
	if err != nil {
		return nil, err
	}

	if curve == Curve_P256 {
		sig, err = p256.Normalize(sig)
		if err != nil {
			return nil, err
		}
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Set t.Version = cert.Version1 (or cert.Version2 if supported by your library version) before signing.
2. Upgrade the nebula library if the certificate uses a newer version constant than the linked code knows.
3. Validate the version right after unmarshaling/constructing the certificate with a switch over known cert.Version constants.

Example fix

// before
t := &cert.NebulaCertificate{Details: cert.NebulaCertificateDetails{}} // Version zero-value
root, err := cert.Sign(nil, key, t)

// after
t := &cert.NebulaCertificate{Details: cert.NebulaCertificateDetails{Version: cert.Version1}}
root, err := cert.Sign(nil, key, t)

switch t.Details.Version {
case cert.Version1, cert.Version2:
    // ok
default:
    return fmt.Errorf("unsupported version %d", t.Details.Version)
}

root, err := cert.Sign(signer, key, t)
if err != nil && strings.Contains(err.Error(), "unknown cert version") {
    // normalize t.Version to a supported constant
    return err
}

When it happens

Trigger: Setting t.Version to an undefined value (e.g. 0, 3, or a value from a newer/older nebula-cert release) before calling SignWith/Sign.

Common situations: Hand-constructing NebulaCertificateDetails and forgetting to set Version: 1, cross-version interop where a v2 cert is fed to an older library that only knows v1, or decoding constants from an incompatible release.

Related errors

• no certificates found in pki.cert
• %s: %w
• can not sign a CA certificate with another
• error computing issuer: %v
• self signed certificates must have IsCA set to true

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/3a8ac5081d48105c. Report an issue: GitHub.