{"record":{"id":"7cc4712d7810489e","repo":"kubernetes/kops","slug":"unrecognized-certificate-option-q","errorCode":null,"errorMessage":"unrecognized certificate option: %q","messagePattern":"unrecognized certificate option: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/issue.go","lineNumber":96,"sourceCode":"\n\ttokens := strings.Split(certificateType, \",\")\n\tfor _, t := range tokens {\n\t\tif strings.HasPrefix(t, \"KeyUsage\") {\n\t\t\tku, found := parseKeyUsage(t)\n\t\t\tif !found {\n\t\t\t\treturn nil, nil, nil, fmt.Errorf(\"unrecognized certificate option: %v\", t)\n\t\t\t}\n\t\t\ttemplate.KeyUsage |= ku\n\t\t} else if strings.HasPrefix(t, \"ExtKeyUsage\") {\n\t\t\tku, found := parseExtKeyUsage(t)\n\t\t\tif !found {\n\t\t\t\treturn nil, nil, nil, fmt.Errorf(\"unrecognized certificate option: %v\", t)\n\t\t\t}\n\t\t\ttemplate.ExtKeyUsage = append(template.ExtKeyUsage, ku)\n\t\t} else if t == \"CA\" {\n\t\t\ttemplate.IsCA = true\n\t\t} else {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"unrecognized certificate option: %q\", t)\n\t\t}\n\t}\n\n\ttemplate.Subject = request.Subject\n\n\tvar alternateNames []string\n\talternateNames = append(alternateNames, request.AlternateNames...)\n\n\tfor _, san := range alternateNames {\n\t\tsan = strings.TrimSpace(san)\n\t\tif san == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif ip := net.ParseIP(san); ip != nil {\n\t\t\ttemplate.IPAddresses = append(template.IPAddresses, ip)\n\t\t} else {\n\t\t\ttemplate.DNSNames = append(template.DNSNames, san)\n\t\t}","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/issue.go#L78-L114","documentation":"The final branch of IssueCert's certificate-type parser: any token that is not a KeyUsage*, ExtKeyUsage*, or the literal \"CA\" is rejected with a quoted error. This is the catch-all for malformed certificate type strings.","triggerScenarios":"Calling IssueCert with request.Type containing an arbitrary token like \"server\" or \"dns:\" (empty/whitespace tokens also land here, e.g. from a trailing comma).","commonSituations":"Typos like \"Ca\" instead of \"CA\", stray commas producing empty tokens, or passing names from a different PKI tool's syntax.","solutions":["Use only recognized tokens: KeyUsage*, ExtKeyUsage*, or \"CA\".","Remove empty tokens caused by stray/trailing commas in the Type string.","Check pkg/pki/issue.go IssueCert for the exact grammar of the Type field."],"exampleFix":"// before\nType: \"KeyUsageDigitalSignature,CA,\"\n// after\nType: \"KeyUsageDigitalSignature,CA\"","handlingStrategy":"validation","validationCode":"func isValidCertType(certType string) bool {\n    for _, t := range strings.Split(certType, \",\") {\n        t = strings.TrimSpace(t)\n        if t == \"\" { return false }\n        if !strings.HasPrefix(t, \"KeyUsage\") && !strings.HasPrefix(t, \"ExtKeyUsage\") && t != \"CA\" {\n            return false\n        }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid stray/trailing commas in the Type string","Spell \"CA\" exactly (uppercase)","Restrict Type values to the documented grammar"],"tags":["pki","certificate","configuration"],"backgroundTag":"invalid-certificate-option","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}