{"record":{"id":"492ffc8f16d85c54","repo":"kubernetes/kops","slug":"signer-certificate-has-neither-rawissuer-nor-autho","errorCode":null,"errorMessage":"signer certificate has neither RawIssuer nor AuthorityKeyId set","messagePattern":"signer certificate has neither RawIssuer nor AuthorityKeyId set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":473,"sourceCode":"}\n\n// validateFetchedIntermediateForSigner checks that a fetched intermediate is actually the issuer\n// referenced by the signer certificate before it is used or cached. This is a structural check\n// only; the cryptographic signature is verified later by verifySignerCertChain.\nfunc validateFetchedIntermediateForSigner(signer *x509.Certificate, cert *x509.Certificate) error {\n\tif signer == nil {\n\t\treturn fmt.Errorf(\"signer certificate is required\")\n\t}\n\tif cert == nil {\n\t\treturn fmt.Errorf(\"fetched certificate is required\")\n\t}\n\tif !cert.IsCA {\n\t\treturn fmt.Errorf(\"fetched certificate is not a CA certificate\")\n\t}\n\t// Require at least one issuer identifier so the per-field length guards below cannot silently\n\t// degrade to \"no identity check\" if both fields happen to be empty.\n\tif len(signer.RawIssuer) == 0 && len(signer.AuthorityKeyId) == 0 {\n\t\treturn fmt.Errorf(\"signer certificate has neither RawIssuer nor AuthorityKeyId set\")\n\t}\n\tif len(signer.RawIssuer) > 0 && !bytes.Equal(cert.RawSubject, signer.RawIssuer) {\n\t\treturn fmt.Errorf(\"fetched certificate subject does not match signer issuer\")\n\t}\n\tif len(signer.AuthorityKeyId) > 0 && !bytes.Equal(cert.SubjectKeyId, signer.AuthorityKeyId) {\n\t\treturn fmt.Errorf(\"fetched certificate subject key identifier does not match signer authority key identifier\")\n\t}\n\n\treturn nil\n}\n\n// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only\n// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them\n// onto the configured scheme and host.\nfunc microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {\n\tif signer == nil {\n\t\treturn nil, fmt.Errorf(\"signer certificate is required\")\n\t}","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L455-L491","documentation":"Guard in validateFetchedIntermediateForSigner: the signer certificate exposes neither a RawIssuer nor an AuthorityKeyId, so there is no identifier to match a fetched intermediate against — the issuer-identity check would silently degrade to a no-op.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:473 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the attestation; the signer certificate is malformed for chain building","Update kOps if Microsoft issues signer certs without issuer identifiers"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}