slackhq/nebula · error

unknown mode: %s

Error message

unknown mode: %s

What it means

main dispatches on the first CLI argument (the sub-command name). If args[0] is not one of the known modes (keygen, ca, sign, print, verify, etc.) it returns this error, then handleError prints it and os.Exit uses its result as the exit code. It is purely a CLI usage error, not a data or environment failure.

Source

Thrown at cmd/nebula-cert/main.go:93

		handleError(args[0], &helpError{}, os.Stderr)
		os.Exit(0)
	}

	var err error

	switch args[0] {
	case "ca":
		err = ca(args[1:], os.Stdout, os.Stderr, StdinPasswordReader{})
	case "keygen":
		err = keygen(args[1:], os.Stdout, os.Stderr)
	case "sign":
		err = signCert(args[1:], os.Stdout, os.Stderr, StdinPasswordReader{})
	case "print":
		err = printCert(args[1:], os.Stdout, os.Stderr)
	case "verify":
		err = verify(args[1:], os.Stdout, os.Stderr)
	default:
		err = fmt.Errorf("unknown mode: %s", args[0])
	}

	if err != nil {
		os.Exit(handleError(args[0], err, os.Stderr))
	}
}

func handleError(mode string, e error, out io.Writer) int {
	code := 1

	// Handle -help, -h flags properly
	if e == flag.ErrHelp {
		code = 0
		e = &helpError{}
	} else if e != nil && e.Error() != "" {
		fmt.Fprintln(out, "Error:", e)
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Re-check the spelling of the sub-command (keygen, ca, sign, print, verify)
2. Run `nebula-cert` with no arguments to print usage
3. Check `nebula-cert -version` and the docs for your version's supported sub-commands
4. Update the binary if the command you need was added in a newer version

Example fix

// before
nebula-cert generate -ca-crt ca.crt -name test
// after
nebula-cert sign -ca-crt ca.crt -name test

modes := map[string]bool{"keygen": true, "ca": true, "sign": true, "print": true, "verify": true}
if len(os.Args) > 1 && !modes[os.Args[1]] {
    fmt.Fprintf(os.Stderr, "unknown mode %q; expected one of keygen|ca|sign|print|verify\n", os.Args[1])
    os.Exit(2)
}

When it happens

Trigger: invoking `nebula-cert <word> ...` where <word> does not match any case in the switch in main (e.g. a typo like `nebula-cert gnerate` or an unsupported sub-command)

Common situations: typos in the sub-command; scripts written for a different tool version that had different commands; copy-pasted commands from documentation of another binary

Understand the failure class

Background: "Unknown argument", "Invalid value", and "must be one of": invalid CLI argument errors explained — this error's family across 35 libraries.

Related errors

• out-key must be encrypted interactively
• error reading passphrase: %s
• no passphrase specified, remove -encrypt flag to write out-k
• invalid curve for PKCS#11: %s
• error while creating PKCS#11 client: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/981615eeed0ab032. Report an issue: GitHub.