{"record":{"id":"88636d17bd36ad4b","repo":"gravitational/teleport","slug":"override-certificate-should-not-be-included-in-cha","errorCode":null,"errorMessage":"override certificate should not be included in chain","messagePattern":"override certificate should not be included in chain","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":290,"sourceCode":"\t\tconst maxChainLength = 10\n\t\tif len(co.GetChain()) > maxChainLength {\n\t\t\treturn nil, \"chain\", fmt.Errorf(\n\t\t\t\t\"certificate chain has too many entries (%d > %d)\", len(co.GetChain()), maxChainLength)\n\t\t}\n\n\t\tchain = make([]*x509.Certificate, len(co.GetChain()))\n\t\tprev := cert\n\t\tfor i, chainPEM := range co.GetChain() {\n\t\t\tchainCert, err := ParseCertificateOverrideCertificate(chainPEM)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Sprintf(\"chain[%d]\", i), err\n\t\t\t}\n\t\t\tchainSub := chainCert.Subject.String()\n\n\t\t\t// Certificate not in chain.\n\t\t\tif i == 0 && cert.Subject.String() == chainSub {\n\t\t\t\treturn nil, fmt.Sprintf(\"chain[%d]\", i),\n\t\t\t\t\terrors.New(\"override certificate should not be included in chain\")\n\t\t\t}\n\n\t\t\t// Issuer/Subject relationship.\n\t\t\tif issuer := prev.Issuer.String(); issuer != chainSub {\n\t\t\t\treturn nil, fmt.Sprintf(\"chain[%d]\", i),\n\t\t\t\t\tfmt.Errorf(\"chain out of order, subject=%q (want %q)\", chainSub, issuer)\n\t\t\t}\n\n\t\t\t// Verify signature.\n\t\t\tif err := prev.CheckSignatureFrom(chainCert); err != nil {\n\t\t\t\treturn nil,\n\t\t\t\t\tfmt.Sprintf(\"chain[%d]\", i),\n\t\t\t\t\tfmt.Errorf(\"chain signature check failed, previous certificate not signed by current: %w\", err)\n\t\t\t}\n\n\t\t\t// Note: we purposefully avoid time-based chain validation at this layer,\n\t\t\t// as that could make an override that was once valid impossible to\n\t\t\t// bootstrap or update without destructive action.","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L272-L308","documentation":"validateCertificateOverride checks that the override certificate is not duplicated inside its own chain. The chain must contain only issuers above the override certificate; if chain[0] has the same Subject as the override certificate itself, the config is redundant/ambiguous and this error is thrown with the field hint 'chain[0]'.","triggerScenarios":"Calling ValidateAndParseCAOverride where co.Chain[0]'s Subject string equals the Subject of the parsed override certificate, i.e. the same cert was pasted into both fields.","commonSituations":"Copying an entire PEM file (override cert + intermediates) into both 'cert' and 'chain'; scripts that split PEM bundles off-by-one so the CA lands in both fields; hand-built chains that start with the CA itself instead of its issuer.","solutions":["Remove the duplicate certificate from the beginning of the chain; the chain should start with the direct issuer of the override certificate.","If the certificate is the root of what you have, drop the chain entirely and supply only the override certificate.","Rebuild the chain bottom-up: chain[0] must issue the override cert, each following entry must issue the previous one."],"exampleFix":"// before\nchain[0] = override cert (same Subject) -> rejected\n// after\nchain[0] = intermediate that signed the override cert\nchain[1] = root (optional)","handlingStrategy":"validation","validationCode":"certSub := parseSubject(override.Cert)\nif len(override.Chain) > 0 && parseSubject(override.Chain[0]) == certSub {\n    return fmt.Errorf(\"override certificate duplicated in chain[0]\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Compare Subject strings of cert and chain[0] before submitting the override.","Generate chains programmatically with a bottom-up issuer walk instead of hand-pasting PEMs.","Keep the override certificate in exactly one field."],"tags":["x509","certificate","configuration","chain-of-trust"],"backgroundTag":"ca-override-chain-validation","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}