{"record":{"id":"61c1c9984749da9f","repo":"kubernetes/kops","slug":"publickey-not-set-and-cannot-be-determined-from","errorCode":null,"errorMessage":"PublicKey not set, and cannot be determined from %T","messagePattern":"PublicKey not set, and cannot be determined from %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/csr.go","lineNumber":53,"sourceCode":"\trandomComponent, err := crypto_rand.Int(crypto_rand.Reader, randomLimit)\n\tif err != nil {\n\t\tklog.Fatalf(\"error generating random number: %v\", err)\n\t}\n\n\tserial := big.NewInt(timestamp)\n\tserial.Lsh(serial, 32)\n\tserial.Or(serial, randomComponent)\n\n\treturn serial\n}\n\nfunc signNewCertificate(privateKey *PrivateKey, template *x509.Certificate, signer *x509.Certificate, signerPrivateKey *PrivateKey) (*Certificate, error) {\n\tif template.PublicKey == nil {\n\t\ttemplate.PublicKey = privateKey.Key.Public()\n\t}\n\n\tif template.PublicKey == nil {\n\t\treturn nil, fmt.Errorf(\"PublicKey not set, and cannot be determined from %T\", privateKey)\n\t}\n\n\tnow := time.Now()\n\tif template.NotBefore.IsZero() {\n\t\ttemplate.NotBefore = now.Add(time.Hour * -48)\n\t}\n\n\tif template.NotAfter.IsZero() {\n\t\ttemplate.NotAfter = now.Add(time.Hour * 10 * 365 * 24)\n\t}\n\n\tif template.SerialNumber == nil {\n\t\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\t\tserialNumber, err := crypto_rand.Int(crypto_rand.Reader, serialNumberLimit)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error generating certificate serial number: %s\", err)\n\t\t}\n\t\ttemplate.SerialNumber = serialNumber","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/csr.go#L35-L71","documentation":"Fires in signNewCertificate when the certificate template has a nil PublicKey and the provided private key also exposes no public key, so the CSR cannot be signed — the input at fault is a PrivateKey whose key material cannot yield a public key.","triggerScenarios":"Thrown at pkg/pki/csr.go:53 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a PrivateKey with a valid RSA/ECDSA key so its public key can be derived","Set template.PublicKey explicitly before signing","Verify the private key was parsed successfully and is not zero-valued"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}