{"record":{"id":"58c29c5b7d64578f","repo":"kubernetes/kops","slug":"intermediate-certificate-from-s-exceeds-d-bytes","errorCode":null,"errorMessage":"intermediate certificate from %s exceeds %d bytes","messagePattern":"intermediate certificate from (.+?) exceeds (.+?) bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":447,"sourceCode":"func fetchCertificate(client *http.Client, url string) (*x509.Certificate, error) {\n\tresp, err := client.Get(url)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fetching intermediate certificate from %s: %w\", url, err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"fetching intermediate certificate from %s: status %d\", url, resp.StatusCode)\n\t}\n\n\t// Cap the body read to reject pathologically large responses. Read one extra byte so we can\n\t// distinguish \"at the limit\" from \"exceeded limit\".\n\tbody, err := io.ReadAll(io.LimitReader(resp.Body, intermediateCertMaxResponseBytes+1))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading intermediate certificate from %s: %w\", url, err)\n\t}\n\tif len(body) > intermediateCertMaxResponseBytes {\n\t\treturn nil, fmt.Errorf(\"intermediate certificate from %s exceeds %d bytes\", url, intermediateCertMaxResponseBytes)\n\t}\n\n\tcert, err := x509.ParseCertificate(body)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing intermediate certificate from %s: %w\", url, err)\n\t}\n\treturn cert, nil\n}\n\n// validateFetchedIntermediateForSigner checks that a fetched intermediate is actually the issuer\n// referenced by the signer certificate before it is used or cached. This is a structural check\n// only; the cryptographic signature is verified later by verifySignerCertChain.\nfunc validateFetchedIntermediateForSigner(signer *x509.Certificate, cert *x509.Certificate) error {\n\tif signer == nil {\n\t\treturn fmt.Errorf(\"signer certificate is required\")\n\t}\n\tif cert == nil {\n\t\treturn fmt.Errorf(\"fetched certificate is required\")","sourceCodeStart":429,"sourceCodeEnd":465,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L429-L465","documentation":"To reject pathologically large or malicious responses, fetchCertificate caps the body at intermediateCertMaxResponseBytes. Because the LimitReader allows one extra byte, a body that fills the limit plus one means the response exceeded the cap, and this error is returned instead of attempting to parse an oversized payload.","triggerScenarios":"An AIA URL returns a body larger than intermediateCertMaxResponseBytes — e.g. a misconfigured endpoint serving a bundle, an HTML error page with inline assets, or a compromised/hostile endpoint.","commonSituations":"Proxy or captive portal returning a large HTML page instead of the DER certificate; endpoint serving a PKCS#7 bundle instead of a single DER certificate; security probing of the AIA URL.","solutions":["Verify the URL returns a single DER-encoded certificate (curl the URL and inspect with openssl)","Check for proxies/captive portals intercepting the request","If legitimately larger certificates are needed, raise intermediateCertMaxResponseBytes in the code"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Probe that the endpoint returns small, certificate-like content before fetching\nresp, err := http.Get(url)\nif err != nil { return err }\nct := resp.Header.Get(\"Content-Type\")\ncl := resp.ContentLength\nresp.Body.Close()\nif cl > 100000 || (ct != \"\" && strings.Contains(ct, \"text/html\")) {\n    return fmt.Errorf(\"endpoint %s unlikely to serve a DER certificate\", url)\n}","typeGuard":null,"tryCatchPattern":"_, err := fetchCertificate(client, url)\nif err != nil && strings.Contains(err.Error(), \"exceeds\") {\n    return nil, fmt.Errorf(\"AIA endpoint %s returned oversized payload; check for proxy/captive portal\", url)\n}","preventionTips":["Check for proxies/captive portals on nodes that fetch CA material","Expect a single DER certificate; investigate any multi-cert bundle endpoints","Keep the size cap as a security control; do not blindly raise it"],"tags":["azure","tls","certificates","response-size","aia-fetch"],"backgroundTag":"response-size-limit-exceeded","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}