slackhq/nebula · error

unknown certificate version %v

Error message

unknown certificate version %v

What it means

While scanning the certificates in pki.cert, newCertStateFromConfig hit a certificate whose version is neither Version1 nor Version2. The loaded cert library does not recognize the version, so it refuses to build cert state.

Source

Thrown at pki.go:356

		}

		if fips140.Enforced() && crt.Curve() != cert.Curve_P256 {
			return nil, fmt.Errorf("pki: use of %s is not allowed in FIPS 140-only mode", crt.Curve())
		}

		switch crt.Version() {
		case cert.Version1:
			if v1 != nil {
				return nil, fmt.Errorf("v1 certificate already found in pki.cert")
			}
			v1 = crt
		case cert.Version2:
			if v2 != nil {
				return nil, fmt.Errorf("v2 certificate already found in pki.cert")
			}
			v2 = crt
		default:
			return nil, fmt.Errorf("unknown certificate version %v", crt.Version())
		}

		if len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == "" {
			break
		}
	}

	if v1 == nil && v2 == nil {
		return nil, errors.New("no certificates found in pki.cert")
	}

	useInitiatingVersion := uint32(1)
	if v1 == nil {
		// The only condition that requires v2 as the default is if only a v2 certificate is present
		// We do this to avoid having to configure it specifically in the config file
		useInitiatingVersion = 2
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Replace pki.cert with a freshly generated/valid nebula certificate
2. Upgrade the nebula binary so it supports the certificate version in the file
3. Validate the certificate: nebula-cert print -path pki.cert

Example fix

// before
# pki.cert contains a cert from a newer nebula (unsupported version)
// after
nebula-cert ca -name 'my ca'   # and re-issue the host cert with the supported version
nebula-cert sign -ca-crt ca.crt -ca-key ca.key -name host1 -ip 10.0.0.1/24

// pre-flight parse of every cert in pki.cert
func validateCertVersions(pkiCertPEM []byte) error {
    rest := pkiCertPEM
    for len(rest) > 0 {
        crt, r, err := cert.UnmarshalCertificate(rest)
        if err != nil { return fmt.Errorf("unparsable cert in pki.cert: %w", err) }
        if v := crt.Version(); v != cert.Version1 && v != cert.Version2 {
            return fmt.Errorf("unsupported cert version: %v", v)
        }
        rest = r
    }
    return nil
}

func isKnownVersion(c cert.Certificate) bool {
    return c.Version() == cert.Version1 || c.Version() == cert.Version2
}

When it happens

Trigger: newCertStateFromConfig (via reloadCerts) encounters a certificate returned by cert.UnmarshalCertificate whose Version() is not 1 or 2 — e.g. a corrupted, truncated, or future-version certificate inside pki.cert.

Common situations: pki.cert corrupted by partial write/truncation; a certificate produced by a newer nebula version than the binary supports; a foreign/wrong PEM blob pasted into pki.cert.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no certificates found in pki.cert
• %s: %w
• can not sign a CA certificate with another
• error computing issuer: %v
• self signed certificates must have IsCA set to true

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/af242f67e80161e4. Report an issue: GitHub.