slackhq/nebula · error

unknown pki.initiating_version: %v

Error message

unknown pki.initiating_version: %v

What it means

Validation error in newCertStateFromConfig: pki.initiating_version was set to a value other than 1 or 2, so the switch on the configured uint32 matched no case. (Values 1 and 2 are handled explicitly, including the guard requiring a v1 cert for version 1.)

Source

Thrown at pki.go:386

	useInitiatingVersion := uint32(1)
	if v1 == nil {
		// The only condition that requires v2 as the default is if only a v2 certificate is present
		// We do this to avoid having to configure it specifically in the config file
		useInitiatingVersion = 2
	}

	rawInitiatingVersion := c.GetUint32("pki.initiating_version", useInitiatingVersion)
	var initiatingVersion cert.Version
	switch rawInitiatingVersion {
	case 1:
		if v1 == nil {
			return nil, fmt.Errorf("can not use pki.initiating_version 1 without a v1 certificate in pki.cert")
		}
		initiatingVersion = cert.Version1
	case 2:
		initiatingVersion = cert.Version2
	default:
		return nil, fmt.Errorf("unknown pki.initiating_version: %v", rawInitiatingVersion)
	}

	return newCertState(initiatingVersion, v1, v2, isPkcs11, curve, rawKey, cipher)
}

func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte, cipher string) (*CertState, error) {
	cs := CertState{
		privateKey:               privateKey,
		pkcs11Backed:             pkcs11backed,
		cipher:                   cipher,
		myVpnNetworksTable:       new(bart.Lite),
		myVpnAddrsTable:          new(bart.Lite),
		myVpnBroadcastAddrsTable: new(bart.Lite),
	}

	if v1 != nil && v2 != nil {
		if !slices.Equal(v1.PublicKey(), v2.PublicKey()) {
			return nil, util.NewContextualError("v1 and v2 public keys are not the same, ignoring", nil, nil)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Set pki.initiating_version to exactly 1 or 2
2. Remove the key entirely to use the default behavior
3. Quote-check the YAML so it parses as an integer

Example fix

// before
pki:
  initiating_version: 3
// after
pki:
  initiating_version: 2

// validate config before load
func validInitiatingVersion(v uint32) bool { return v == 1 || v == 2 }
// usage: if !validInitiatingVersion(cfg.GetUint32("pki.initiating_version", 2)) { reject config }

func isInitiatingVersion(v uint32) bool { return v == 1 || v == 2 }

When it happens

Trigger: newCertStateFromConfig (via reloadCerts) reads pki.initiating_version with a value other than 1 or 2 (e.g. 0, 3, or a non-numeric string resolved to 0).

Common situations: Typo in config (initiating_version: 12 or 2.0); YAML value parsed as 0; copied config from an unsupported docs page.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Empty configuration
• group should contain a single value, an array with more than
• no certificate state
• no pki.key path or PEM data provided
• no pki.cert path or PEM data provided

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/9d4b30a2fc61a62b. Report an issue: GitHub.