{"record":{"id":"6a59a79a78f006f8","repo":"kubernetes/kops","slug":"verifying-pkcs7-certificate-chain-with-embedded-in","errorCode":null,"errorMessage":"verifying PKCS7 certificate chain with embedded intermediates: %w","messagePattern":"verifying PKCS7 certificate chain with embedded intermediates: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":212,"sourceCode":"\t// The signature binds this content to the (still-untrusted) leaf, so it is safe to run\n\t// rejection-only checks (nonce, freshness) before paying for chain building or network fetches\n\t// below.\n\tdata, err := parseAndValidateAttestedDocumentContent(p7.Content, body)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Verify using only the certificates embedded in the PKCS7 structure; if that succeeds, the signer\n\t// is trusted. If it fails but the PKCS7 already embeds a cert matching the signer's issuer, the\n\t// chain is genuinely broken (not just missing an intermediate), so fail fast instead of fetching.\n\tchainErr := verifySignerCertChain(signer, p7.Certificates, rootCertPool, x509.NewCertPool())\n\tif chainErr == nil {\n\t\tklog.V(2).Infof(\"PKCS7 certificate chain verified with embedded certificates for signer issuer %q\", signer.Issuer)\n\t\treturn data, nil\n\t}\n\tfor _, cert := range p7.Certificates {\n\t\tif validateFetchedIntermediateForSigner(signer, cert) == nil {\n\t\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain with embedded intermediates: %w\", chainErr)\n\t\t}\n\t}\n\n\tklog.V(4).Infof(\"Resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\tintermediateCerts, err := fetchIntermediates(signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fetching intermediate certificates: %w\", err)\n\t}\n\tif err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {\n\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain: %w\", err)\n\t}\n\tklog.V(4).Infof(\"PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\n\treturn data, nil\n}\n\n// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its\n// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L194-L230","documentation":"The signer certificate failed to chain to the trusted root using only the certificates embedded in the PKCS7 attestation, AND the PKCS7 already contained a matching issuer certificate — proving the chain is genuinely broken rather than merely missing an intermediate, so verification fails fast instead of fetching.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:212 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Treat the attestation as untrusted; reject the token","Verify the embedded root pool includes the current Microsoft PKI roots (Microsoft may have rotated intermediates)","Update kops to pick up refreshed root certificates"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}