{"record":{"id":"1bc6e114a5e9cb90","repo":"kubernetes/kops","slug":"failed-to-create-certificate-w","errorCode":null,"errorMessage":"failed to create certificate: %w","messagePattern":"failed to create certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/challenge.go","lineNumber":87,"sourceCode":"\n\ttemplate := x509.Certificate{\n\t\tSerialNumber: big.NewInt(1),\n\t\tSubject: pkix.Name{\n\t\t\tCommonName: serverName,\n\t\t},\n\t\tNotBefore: notBefore,\n\t\tNotAfter:  notAfter,\n\n\t\tKeyUsage:              keyUsage,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},\n\t\tBasicConstraintsValid: true,\n\t}\n\n\ttemplate.DNSNames = append(template.DNSNames, serverName)\n\n\tder, err := x509.CreateCertificate(cryptorand.Reader, &template, &template, privateKey.Key.Public(), privateKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create certificate: %w\", err)\n\t}\n\n\tparsed, err := x509.ParseCertificate(der)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t}\n\ttlsCertificate := &tls.Certificate{\n\t\tPrivateKey:  privateKey.Key,\n\t\tCertificate: [][]byte{parsed.Raw},\n\t\tLeaf:        parsed,\n\t}\n\n\treturn tlsCertificate, nil\n}\n","sourceCodeStart":69,"sourceCodeEnd":102,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/challenge.go#L69-L102","documentation":"BuildChallengeServerCertificate wraps an error from x509.CreateCertificate when self-signing the challenge server certificate. Given the key was already generated, failures here stem from invalid template fields or crypto-layer problems (e.g. bad issuer/subject key pairing or invalid validity).","triggerScenarios":"NewChallengeServer triggers certificate creation; x509.CreateCertificate(cryptorand.Reader, &template, &template, privateKey.Key.Public(), privateKey.Key) returns an error, e.g. template fields (SerialNumber, DNSNames, KeyUsage) constructed inconsistently or an internal RSA/ECDSA mismatch.","commonSituations":"Bugs introduced when editing the certificate template; platform crypto restrictions; time-related issues if notBefore/notAfter logic is changed; extremely rare in stock kops since the template is fixed.","solutions":["Inspect the wrapped error message (%w chain) for the exact x509 cause","Verify the template: publicKey matches the signer's private key and DNSNames includes the challenge server hostname","Confirm the host clock is sane (notBefore = now-15min; huge clock skew can produce invalid validity windows)","Upgrade kops — stock code paths rarely fail here; a custom patch may have broken the template"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"cert, err := BuildChallengeServerCertificate(clusterName)\nif err != nil {\n  return fmt.Errorf(\"challenge server startup failed: %w\", err)\n}","preventionTips":["Keep host clocks synchronized so certificate validity windows are sane","Do not hand-edit the certificate template without testing certificate creation","Use stock kops builds; report failures with the wrapped x509 cause"],"tags":["tls","x509","certificate","challenge"],"backgroundTag":"certificate-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}