From 0aa15ef247657738e0d3c014be5294000ea59239 Mon Sep 17 00:00:00 2001
From: JackDoan <me@jackdoan.com>
Date: Wed, 14 Oct 2026 13:58:40 -0500
Subject: [PATCH] nebula-cert: Lead print output for a version 3 certificate
 with both fingerprints, and say the v2 one blocks both forms

---
 cmd/nebula-cert/pq_test.go | 12 ++++++++++++
 cmd/nebula-cert/print.go   | 13 +++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/cmd/nebula-cert/pq_test.go b/cmd/nebula-cert/pq_test.go
index 5faa0d35..8d34feff 100644
--- a/cmd/nebula-cert/pq_test.go
+++ b/cmd/nebula-cert/pq_test.go
@@ -156,6 +156,18 @@ func TestPQ_Extend(t *testing.T) {
 			require.NoError(t, verifiedBy(t, host3, ca3))
 			require.NoError(t, verifiedBy(t, host2, ca2), "existing trust is untouched")
 
+			// print leads a version 3 certificate with both fingerprints and says which one blocks both forms.
+			ob.Reset()
+			require.NoError(t, printCert([]string{"-path", p("host3.crt")}, ob, eb))
+			fp3, err := host3.Fingerprint()
+			require.NoError(t, err)
+			fp2, err := host2.Fingerprint()
+			require.NoError(t, err)
+			printed := ob.String()
+			lead := "Fingerprint:    " + fp3 + "\nv2 fingerprint: " + fp2 + "  (block this one in pki.blocklist, it covers both forms)\n"
+			require.Greater(t, len(printed), len(lead))
+			assert.Equal(t, lead, printed[:len(lead)])
+
 			// Someone else's key does not extend this host.
 			require.NoError(t, keygen([]string{"-version", "3", "-out-key", p("other.key"), "-out-pub", p("other.pub")}, ob, eb))
 			require.ErrorContains(t, pqExtend([]string{"-in-crt", p("host.crt"), "-in-pub", p("other.pub"), "-ca-crt", p("ca3.crt"), "-ca-key", p("ca3.key"), "-out-crt", p("bad.crt")}, ob, eb, pw), "does not extend the key")
diff --git a/cmd/nebula-cert/print.go b/cmd/nebula-cert/print.go
index 3ba0571e..96f1189e 100644
--- a/cmd/nebula-cert/print.go
+++ b/cmd/nebula-cert/print.go
@@ -73,6 +73,19 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 			if *pf.json {
 				jsonCerts = append(jsonCerts, c)
 			} else {
+				// A version 3 certificate has two fingerprints, and only the v2 one blocks both of its forms.
+				// Lead with them so the right one is the obvious one to copy.
+				if v2 := cert.V2Form(c); v2 != nil {
+					fp, err := c.Fingerprint()
+					if err != nil {
+						return fmt.Errorf("error while computing fingerprint: %s", err)
+					}
+					v2fp, err := v2.Fingerprint()
+					if err != nil {
+						return fmt.Errorf("error while computing v2 fingerprint: %s", err)
+					}
+					_, _ = fmt.Fprintf(out, "Fingerprint:    %s\nv2 fingerprint: %s  (block this one in pki.blocklist, it covers both forms)\n", fp, v2fp)
+				}
 				_, _ = out.Write([]byte(c.String()))
 				_, _ = out.Write([]byte("\n"))
 			}