{"record":{"id":"9331238750e780b6","repo":"kubernetes/kops","slug":"error-converting-public-key-to-x509-w","errorCode":null,"errorMessage":"error converting public key to x509: %w","messagePattern":"error converting public key to x509: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/pkibootstrap/pkisigner.go","lineNumber":76,"sourceCode":"\tAudience string `json:\"audience,omitempty\"`\n}\n\nvar _ bootstrap.Authenticator = &pkiAuthenticator{}\n\nfunc NewAuthenticator(hostname string, signer crypto.Signer) (bootstrap.Authenticator, error) {\n\tkeyID, err := computeKeyID(signer)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &pkiAuthenticator{hostname: hostname, signer: signer, keyID: keyID}, nil\n}\n\nfunc computeKeyID(signer crypto.Signer) (string, error) {\n\tpublicKey := signer.Public()\n\tpkData, err := x509.MarshalPKIXPublicKey(publicKey)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error converting public key to x509: %w\", err)\n\t}\n\n\tvar b bytes.Buffer\n\tif err := pem.Encode(&b, &pem.Block{Type: \"PUBLIC KEY\", Bytes: pkData}); err != nil {\n\t\treturn \"\", fmt.Errorf(\"error encoding public key: %w\", err)\n\t}\n\treturn b.String(), nil\n}\n\nfunc NewAuthenticatorFromFile(p string) (bootstrap.Authenticator, error) {\n\thostname, err := os.Hostname()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"couldn't determine hostname: %w\", err)\n\t}\n\n\tkeyBytes, err := os.ReadFile(p)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error reading %q: %w\", p, err)","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/pkibootstrap/pkisigner.go#L58-L94","documentation":"computeKeyID derives a key identifier by marshaling the signer's public key to x509 PKIX form (then PEM/SHA hashing). MarshalPKIXPublicKey fails if the underlying public key type is unsupported by the standard library. NewAuthenticator surfaces this when the signer passed in has an exotic or nil public key.","triggerScenarios":"Calling NewAuthenticator with a crypto.Signer whose Public() returns an unsupported key type (not RSA/ECDSA/Ed25519) or fails, causing x509.MarshalPKIXPublicKey to error.","commonSituations":"Custom or hardware-backed signer (HSM/PKCS#11 wrapper) exposing an unregistered key type; a nil or incorrectly initialized signer; Go version that doesn't recognize the curve used by the key.","solutions":["Use a standard key type (RSA, ECDSA, Ed25519) for the signer passed to NewAuthenticator","Check that the signer is fully initialized and Public() returns a concrete supported key","Upgrade Go if the key uses a newer curve than the toolchain supports","If using an HSM wrapper, export/extract a supported public key representation"],"exampleFix":"// before\nsigner, _ := customPKCS11.Signer(nil) // exotic key type\nauth, err := pkibootstrap.NewAuthenticator(cluster, signer)\n// after\nsigner, _ := rsa.GenerateKey(rand.Reader, 2048)\nauth, err := pkibootstrap.NewAuthenticator(cluster, signer)","handlingStrategy":"validation","validationCode":"pub := signer.Public()\nswitch pub.(type) {\ncase *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:\ndefault:\n\treturn fmt.Errorf(\"unsupported public key type %T for authenticator\", pub)\n}","typeGuard":null,"tryCatchPattern":"auth, err := pkibootstrap.NewAuthenticator(cluster, signer)\nif err != nil && strings.Contains(err.Error(), \"converting public key to x509\") {\n\t// swap in a standard RSA/ECDSA/Ed25519 signer\n\treturn err\n}","preventionTips":["Generate signing keys with standard algorithms (RSA 2048+, ECDSA P-256, Ed25519)","Initialize the signer fully before constructing the authenticator","Keep HSM wrappers exporting supported public key types"],"tags":["crypto","x509","pki","key-format"],"backgroundTag":"unsupported-public-key","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}