{"record":{"id":"6039c8ad470bbbdf","repo":"kubernetes/kops","slug":"client-certificate-missing-common-name","errorCode":null,"errorMessage":"client certificate missing Common Name","messagePattern":"client certificate missing Common Name","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/pkg/discovery/auth.go","lineNumber":90,"sourceCode":"\tvar matchingChain []*x509.Certificate\n\tfor _, verifiedChain := range verifiedChains {\n\t\tfor _, cert := range verifiedChain {\n\t\t\thash := sha256.Sum256(cert.RawSubjectPublicKeyInfo)\n\t\t\tcalculatedUniverseID := hex.EncodeToString(hash[:])\n\t\t\tif calculatedUniverseID == universeID {\n\t\t\t\tmatchingChain = verifiedChain\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\n\tif matchingChain == nil {\n\t\treturn nil, fmt.Errorf(\"client certificate chain does not match universe ID\")\n\t}\n\n\tclientID := matchingChain[0].Subject.CommonName\n\tif clientID == \"\" {\n\t\treturn nil, fmt.Errorf(\"client certificate missing Common Name\")\n\t}\n\n\treturn &UserInfo{\n\t\tUniverseID: universeID,\n\t\tClientID:   clientID,\n\t}, nil\n}\n","sourceCodeStart":72,"sourceCodeEnd":98,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/discovery/pkg/discovery/auth.go#L72-L98","documentation":"AuthenticateClientToUniverse derives the client's identity from the Common Name (CN) of the leaf certificate in the verified chain. If Subject.CommonName is empty there is no client ID to return, so authentication fails with this error.","triggerScenarios":"Presenting a client certificate whose leaf has an empty Subject CN, even though the chain verified and matched the universe ID.","commonSituations":"Certificates generated with CSR templates omitting CN (e.g. only O/OU set, or modern tooling using SANs only); certs issued by CSRs lacking a CommonName field.","solutions":["Re-issue the client certificate ensuring the CSR includes a Subject CommonName.","Set CN when generating the key/cert (e.g. openssl req -subj \"/CN=my-client\" or cert-manager commonName field).","Confirm the signing tooling did not strip the Subject during issuance."],"exampleFix":"// before: CSR without CN\nopenssl req -new -subj \"/O=org\" -key client.key -out client.csr\n// after\nopenssl req -new -subj \"/O=org/CN=my-client\" -key client.key -out client.csr","handlingStrategy":"validation","validationCode":"if leaf.Subject.CommonName == \"\" {\n\treturn errors.New(\"refusing to use client cert with empty CN; regenerate with a CommonName\")\n}","typeGuard":"func hasCommonName(cert *x509.Certificate) bool {\n\treturn cert != nil && cert.Subject.CommonName != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always include CN in certificate CSRs/templates (cert-manager: spec.commonName).","Add a linting step (e.g. certchain linters) validating Subject.CommonName on issued certs.","Never rely solely on SANs when the authenticator derives identity from CN."],"tags":["mtls","certificate","common-name","identity"],"backgroundTag":"certificate-missing-common-name","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}