{"record":{"id":"6b6d9f8d28f9f9fd","repo":"kubernetes/kops","slug":"no-valid-microsoft-pki-aia-urls-found","errorCode":null,"errorMessage":"no valid Microsoft PKI AIA URLs found","messagePattern":"no valid Microsoft PKI AIA URLs found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":521,"sourceCode":"\t\treturn nil, fmt.Errorf(\"base URL path is too broad\")\n\t}\n\n\tvar urls []string\n\tseen := make(map[string]struct{})\n\tfor _, rawURL := range signer.IssuingCertificateURL {\n\t\tnormalized, ok := normalizeMicrosoftIntermediateURL(base, basePath, rawURL)\n\t\tif !ok {\n\t\t\tcontinue\n\t\t}\n\t\tif _, found := seen[normalized]; found {\n\t\t\tcontinue\n\t\t}\n\t\tseen[normalized] = struct{}{}\n\t\turls = append(urls, normalized)\n\t}\n\n\tif len(urls) == 0 {\n\t\treturn nil, fmt.Errorf(\"no valid Microsoft PKI AIA URLs found\")\n\t}\n\n\treturn urls, nil\n}\n\n// normalizeMicrosoftIntermediateURL copies only the allowed parts of a signer AIA URL onto the\n// configured Microsoft PKI base URL. This keeps the path we need while ignoring attacker-controlled\n// scheme, query, fragment, and userinfo.\nfunc normalizeMicrosoftIntermediateURL(base *url.URL, basePath string, rawURL string) (string, bool) {\n\tcandidate, err := url.Parse(rawURL)\n\tif err != nil {\n\t\treturn \"\", false\n\t}\n\tif candidate.User != nil || candidate.RawQuery != \"\" || candidate.Fragment != \"\" {\n\t\treturn \"\", false\n\t}\n\tif candidate.Scheme != \"http\" && candidate.Scheme != \"https\" {\n\t\treturn \"\", false","sourceCodeStart":503,"sourceCodeEnd":539,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L503-L539","documentation":"None of the signer certificate's AIA (IssuingCertificateURL) entries survived normalization onto the Microsoft PKI allowlist, so there is no permitted URL from which to fetch intermediates. Either the signer has no AIA entries or all point outside the allowed host/path.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:521 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the attestation; the signer is not chainable within the Microsoft PKI allowlist","Update kOps if Microsoft moved its intermediate hosting to a new allowlisted location"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}