{"record":{"id":"47afb9b590449ebf","repo":"kubernetes/kops","slug":"ca-key-for-q-was-not-found-cannot-issue-certific","errorCode":null,"errorMessage":"ca key for %q was not found; cannot issue certificates","messagePattern":"ca key for %q was not found; cannot issue certificates","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/pki/issue.go","lineNumber":126,"sourceCode":"\t\t\tcontinue\n\t\t}\n\t\tif ip := net.ParseIP(san); ip != nil {\n\t\t\ttemplate.IPAddresses = append(template.IPAddresses, ip)\n\t\t} else {\n\t\t\ttemplate.DNSNames = append(template.DNSNames, san)\n\t\t}\n\t}\n\n\tvar caPrivateKey *PrivateKey\n\tvar signer *x509.Certificate\n\tif !template.IsCA {\n\t\tvar err error\n\t\tcaCertificate, caPrivateKey, err = keystore.FindPrimaryKeypair(ctx, request.Signer)\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, err\n\t\t}\n\t\tif caPrivateKey == nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"ca key for %q was not found; cannot issue certificates\", request.Signer)\n\t\t}\n\t\tif caCertificate == nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"ca certificate for %q was not found; cannot issue certificates\", request.Signer)\n\t\t}\n\t\tsigner = caCertificate.Certificate\n\t}\n\n\tprivateKey := request.PrivateKey\n\tif request.PublicKey != nil {\n\t\ttemplate.PublicKey = request.PublicKey\n\t} else if privateKey == nil {\n\t\tvar err error\n\t\tprivateKey, err = GeneratePrivateKey()\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, err\n\t\t}\n\t}\n","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/issue.go#L108-L144","documentation":"IssueCert looked up the signing CA via keystore.FindPrimaryKeypair and got a result whose private key is nil. Without the CA private key, kOps cannot sign new certificates, so it refuses rather than issuing a certificate it cannot sign.","triggerScenarios":"Requesting issuance with request.Signer set to a CA name (e.g. \"kubernetes-ca\") whose keyset contains a certificate but no private key — e.g. the CA keypair was never created, or only the public part was imported/restored.","commonSituations":"Restoring a cluster state store from a backup that omitted private keys, manually importing CA certs into the keyset, or issuing certificates before installPKI created the CA.","solutions":["Recreate or restore the CA keypair in the keystore (kops toolbox pki / re-run installPKI) so the private key exists.","Restore the missing private key backing file in the state store keyset (e.g. under <cluster>/pki/private/...).","Issue the certificate with a signer whose keypair is complete."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cert, key, err := keystore.FindPrimaryKeypair(ctx, signer)\nif err != nil { return err }\nif key == nil {\n    return fmt.Errorf(\"CA %s private key missing; restore keyset first\", signer)\n}","typeGuard":"func caReady(kp *pki.Keypair) bool {\n    return kp != nil && kp.Certificate != nil && kp.PrivateKey != nil\n}","tryCatchPattern":"if err := installPKI(...); err != nil {\n    if strings.Contains(err.Error(), \"ca key for\") {\n        // recreate/restore CA keyset, then retry once\n    }\n    return err\n}","preventionTips":["Run installPKI before any certificate issuance","Include private keyset files in state-store backups","Never import only the public half of a CA"],"tags":["pki","ca","keystore","missing-key"],"backgroundTag":"missing-ca-private-key","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}