{"record":{"id":"4aedda629e291196","repo":"k3s-io/k3s","slug":"token-ca-hash-does-not-match-the-cluster-ca-certif","errorCode":null,"errorMessage":"token CA hash does not match the Cluster CA certificate hash: %s != %s","messagePattern":"token CA hash does not match the Cluster CA certificate hash: (.+?) != (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/clientaccess/token.go","lineNumber":403,"sourceCode":"\n\ti.BaseURL = url.String()\n\treturn nil\n}\n\n// ValidateCAHash validates that info's caHash matches the CACerts hash.\nfunc (i *Info) validateCAHash() error {\n\tif len(i.caHash) > 0 && len(i.CACerts) == 0 {\n\t\t// Warn if the user provided a CA hash but we're not going to validate because it's already trusted\n\t\tlogrus.Warn(\"Cluster CA certificate is trusted by the host CA bundle. \" +\n\t\t\t\"Token CA hash will not be validated.\")\n\t} else if len(i.caHash) == 0 && len(i.CACerts) > 0 {\n\t\t// Warn if the CA is self-signed but the user didn't provide a hash to validate it against\n\t\tlogrus.Warn(\"Cluster CA certificate is not trusted by the host CA bundle, but the token does not include a CA hash. \" +\n\t\t\t\"Use the full token from the server's node-token file to enable Cluster CA validation.\")\n\t} else if len(i.CACerts) > 0 && len(i.caHash) > 0 {\n\t\t// only verify CA hash if the server cert is not trusted by the OS CA bundle\n\t\tif ok, serverHash := validateCACerts(i.CACerts, i.caHash); !ok {\n\t\t\treturn fmt.Errorf(\"token CA hash does not match the Cluster CA certificate hash: %s != %s\", i.caHash, serverHash)\n\t\t}\n\t}\n\treturn nil\n}\n\n// getCACerts retrieves the CA bundle from a server.\n// An error is raised if the CA bundle cannot be retrieved,\n// or if the server's cert is not signed by the returned bundle.\nfunc getCACerts(u url.URL) ([]byte, error) {\n\tu.Path = \"/cacerts\"\n\turl := u.String()\n\n\t// This first request is expected to fail. If the server has\n\t// a cert that can be validated using the default CA bundle, return\n\t// success with no CA certs.\n\t_, err := get(url, defaultClient, \"\", \"\", \"\")\n\tif err == nil {\n\t\treturn nil, nil","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/clientaccess/token.go#L385-L421","documentation":"Error \"token CA hash does not match the Cluster CA certificate hash: %s != %s\" thrown in k3s-io/k3s.","triggerScenarios":"Thrown at pkg/clientaccess/token.go:403 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}