{"record":{"id":"5bf1ee5878270af3","repo":"kubernetes/kops","slug":"signer-certificate-san-does-not-match-azure-metada","errorCode":null,"errorMessage":"signer certificate SAN does not match Azure metadata domains","messagePattern":"signer certificate SAN does not match Azure metadata domains","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":570,"sourceCode":"\t\tHost:   base.Host,\n\t\tPath:   candidatePath,\n\t}).String(), true\n}\n\n// Azure guidance requires the metadata signer certificate to identify metadata.azure.com or a\n// regional *.metadata.azure.com name in its DNS SANs.\nfunc validateAzureMetadataSignerSAN(signer *x509.Certificate) error {\n\tif signer == nil {\n\t\treturn fmt.Errorf(\"signer certificate is required\")\n\t}\n\n\tfor _, dnsName := range signer.DNSNames {\n\t\tif dnsName == azureMetadataDNSName || strings.HasSuffix(dnsName, azureMetadataSubdomainSuffix) {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn fmt.Errorf(\"signer certificate SAN does not match Azure metadata domains\")\n}\n\n// verifySignerCertChain verifies that the signer certificate chains to a trusted root CA.\nfunc verifySignerCertChain(signer *x509.Certificate, pkcs7Certs []*x509.Certificate, rootCertPool *x509.CertPool, intermediateCerts *x509.CertPool) error {\n\tif signer == nil {\n\t\treturn fmt.Errorf(\"signer certificate is required\")\n\t}\n\tif rootCertPool == nil {\n\t\treturn fmt.Errorf(\"root certificate pool is required\")\n\t}\n\tif intermediateCerts == nil {\n\t\treturn fmt.Errorf(\"intermediate certificate pool is required\")\n\t}\n\n\tintermediates := intermediateCerts.Clone()\n\tfor _, cert := range pkcs7Certs {\n\t\tintermediates.AddCert(cert)\n\t}","sourceCodeStart":552,"sourceCodeEnd":588,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L552-L588","documentation":"The signer certificate of the PKCS7 attestation carries no DNS SAN matching metadata.azure.com or *.metadata.azure.com, so it does not identify as the Azure metadata endpoint and the attestation is not trusted.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:570 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the attestation token","Update kOps if Azure changed the metadata signing certificate's SANs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}