{"record":{"id":"200ea58d9d36aae8","repo":"kubernetes/kops","slug":"error-loading-certificate-q-v","errorCode":null,"errorMessage":"error loading certificate %q: %v","messagePattern":"error loading certificate %q: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":231,"sourceCode":"\t\t\tType:       \"ca\",\n\t\t\tSubject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},\n\t\t\tSerial:     serial,\n\t\t\tPrivateKey: privateKey,\n\t\t}\n\t\tcert, _, _, err = pki.IssueCert(ctx, &req, nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error issuing certificate: %v\", err)\n\t\t}\n\t} else {\n\t\toptions.CertPath = utils.ExpandPath(options.CertPath)\n\t\tcertBytes, err := os.ReadFile(options.CertPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading user provided cert %q: %v\", options.CertPath, err)\n\t\t}\n\n\t\tcert, err = pki.ParsePEMCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading certificate %q: %v\", options.CertPath, err)\n\t\t}\n\t}\n\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tvar item *fi.KeysetItem\n\tif os.IsNotExist(err) || (err == nil && keyset == nil) {\n\t\tif options.Primary {\n\t\t\tif keyset, err = fi.NewKeyset(cert, privateKey); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"the first keypair added to a keyset must be primary\")\n\t\t}\n\t\titem = keyset.Primary\n\t} else if err != nil {\n\t\treturn fmt.Errorf(\"reading existing keyset: %v\", err)\n\t} else {\n\t\titem, err = keyset.AddItem(cert, privateKey, options.Primary)","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L213-L249","documentation":"This error occurs when the file passed via --cert to `kops create keypair` was read successfully but is not a parseable PEM certificate. pki.ParsePEMCertificate rejects the bytes, so the supplied certificate cannot be used for the keyset.","triggerScenarios":"Running `kops create keypair --cert <path>` where the file is not PEM-encoded, is truncated, is a private key or CSR instead of a certificate, or is an empty/garbage file.","commonSituations":"Passing a DER (.cer/.der) binary cert instead of PEM; passing the private key file by mistake; transfers that mangled PEM headers/whitespace; empty file.","solutions":["Verify the file starts with '-----BEGIN CERTIFICATE-----'.","Convert DER to PEM: openssl x509 -inform der -in cert.cer -out cert.pem.","Confirm it is a certificate, not a key or CSR: openssl x509 -in cert.pem -noout -text.","Re-export the certificate to rule out truncation/corruption."],"exampleFix":"// before\nkops create keypair cluster.name kubernetes-ca --cert ca.der\n// error loading certificate: no PEM block found\n// after\nopenssl x509 -inform der -in ca.der -out ca.pem\nkops create keypair cluster.name kubernetes-ca --cert ca.pem","handlingStrategy":"validation","validationCode":"pemBytes, _ := os.ReadFile(certPath)\nblock, _ := pem.Decode(pemBytes)\nif block == nil || block.Type != \"CERTIFICATE\" {\n    return errors.New(\"file is not a PEM certificate\")\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    return fmt.Errorf(\"not a valid x509 cert: %w\", err)\n}","typeGuard":"func isPEMCertificate(b []byte) bool {\n    block, _ := pem.Decode(b)\n    return block != nil && block.Type == \"CERTIFICATE\"\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error loading certificate\") {\n    // verify PEM encoding with openssl and re-export the cert\n}","preventionTips":["Always use PEM ('-----BEGIN CERTIFICATE-----') certs, not DER.","Confirm file type with `file cert.pem` or `openssl x509 -noout -text -in cert.pem`.","Never pass private keys or CSRs via --cert.","Check for truncation after copying certs between systems."],"tags":["certificate","pem","parsing"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}