{"record":{"id":"602b366e7608038c","repo":"kubernetes/kops","slug":"error-creating-certificate-v","errorCode":null,"errorMessage":"error creating certificate: %v","messagePattern":"error creating certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/csr.go","lineNumber":92,"sourceCode":"\tif signer != nil {\n\t\tparent = signer\n\t} else {\n\t\tparent = template\n\t\tsignerPrivateKey = privateKey\n\t}\n\n\tif template.KeyUsage == 0 {\n\t\ttemplate.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment\n\t}\n\n\tif template.ExtKeyUsage == nil && !template.IsCA {\n\t\ttemplate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}\n\t}\n\t// c.SignatureAlgorithm  = do we want to override?\n\n\tcertificateData, err := x509.CreateCertificate(crypto_rand.Reader, template, parent, template.PublicKey, signerPrivateKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating certificate: %v\", err)\n\t}\n\n\tcert, err := x509.ParseCertificate(certificateData)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t}\n\n\tc := &Certificate{\n\t\tSubject:     cert.Subject,\n\t\tIsCA:        cert.IsCA,\n\t\tCertificate: cert,\n\t\tPublicKey:   cert.PublicKey,\n\t}\n\n\treturn c, nil\n}\n","sourceCodeStart":74,"sourceCodeEnd":109,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/csr.go#L74-L109","documentation":"Fires when x509.CreateCertificate fails while producing the signed certificate bytes in signNewCertificate — e.g. unsupported key/algorithm combination, mismatched parent/signer key, or invalid template fields.","triggerScenarios":"Thrown at pkg/pki/csr.go:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped %v error for the x509 cause (algorithm, key type, template field)","Ensure the signer private key matches the signer certificate's public key","Validate template fields (KeyUsage, ExtKeyUsage, validity) are consistent with the key type"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}