{"record":{"id":"900f4873ca8027c4","repo":"gravitational/teleport","slug":"nil-certificate-override","errorCode":null,"errorMessage":"nil certificate override","messagePattern":"nil certificate override","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":225,"sourceCode":"\t\t}\n\t\tseenPublicKeys[parsedCO.PublicKey] = struct{}{}\n\n\t\tparsedOverrides[i] = parsedCO\n\t}\n\n\treturn &ParsedCertAuthorityOverride{\n\t\tCAOverride:           resource,\n\t\tCertificateOverrides: parsedOverrides,\n\t}, nil\n}\n\nfunc validateCertificateOverride(\n\tclusterName string,\n\tco *subcav1.CertificateOverride,\n) (_ *ParsedCertificateOverride, fieldName string, _ error) {\n\t// Trace not used on purpose. Errors are trace-wrapped up in the chain.\n\tif co == nil {\n\t\treturn nil, \"\", errors.New(\"nil certificate override\")\n\t}\n\n\t// Certificate.\n\tvar cert *x509.Certificate\n\tvar wantPublicKey string\n\tif co.GetCertificate() != \"\" {\n\t\tvar err error\n\t\tcert, err = ParseCertificateOverrideCertificate(co.GetCertificate())\n\t\tif err != nil {\n\t\t\treturn nil, \"certificate\", err\n\t\t}\n\t\tif err := validateOverrideCertificate(clusterName, cert); err != nil {\n\t\t\treturn nil, \"certificate\", err\n\t\t}\n\t\twantPublicKey = HashCertificatePublicKey(cert)\n\t}\n\n\t// PublicKey.","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L207-L243","documentation":"validateCertificateOverride rejects a subCA certificate override CR (subcav1.CertificateOverride) that is nil. ValidateAndParseCAOverride parses and validates overrides before they are applied to subordinate CA issuance; a nil override carries no certificate or public key and cannot be validated, so it fails fast with this plain error.","triggerScenarios":"Passing a nil *subcav1.CertificateOverride to ValidateAndParseCAOverride — typically when the override spec in the SubCA resource is absent/unset but the code path unconditionally validates it.","commonSituations":"A YAML/JSON spec for a subordinate CA omits the certificate override block while code expects it present; resource deserialization leaves the field nil.","solutions":["Ensure the SubCA spec includes a certificate_override with either a certificate or a public key before calling ValidateAndParseCAOverride","Check for nil before calling and return a clear config error identifying the missing field"],"exampleFix":"// before\nparsed, field, err := ValidateAndParseCAOverride(clusterName, spec.Override)\n// after\nif spec.Override == nil {\n    return trace.BadParameter(\"subca spec requires a certificate override\")\n}\nparsed, field, err := ValidateAndParseCAOverride(clusterName, spec.Override)","handlingStrategy":"validation","validationCode":"if override == nil {\n    return trace.BadParameter(\"certificate override must be set with a certificate or public key\")\n}\nparsed, _, err := subca.ValidateAndParseCAOverride(clusterName, override)\nif err != nil { return trace.Wrap(err) }","typeGuard":"func hasOverride(o *subcav1.CertificateOverride) bool {\n    return o != nil && (o.GetCertificate() != \"\" || o.GetPublicKey() != \"\")\n}","tryCatchPattern":"parsed, field, err := ValidateAndParseCAOverride(clusterName, co)\nif err != nil {\n    return trace.Wrap(err, \"invalid certificate override (field %q)\", field)\n}","preventionTips":["Always populate certificate or public_key in SubCA override specs","Validate CR fields before submitting the resource","Handle nil fields after deserialization of YAML/JSON specs"],"tags":["subca","validation","config","x509"],"backgroundTag":"nil-certificate-override","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}