{"record":{"id":"94e14a8557f2ed7e","repo":"kubernetes/kops","slug":"ca-certificate-for-q-was-not-found-cannot-issue","errorCode":null,"errorMessage":"ca certificate for %q was not found; cannot issue certificates","messagePattern":"ca certificate for %q was not found; cannot issue certificates","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/pki/issue.go","lineNumber":129,"sourceCode":"\t\t\ttemplate.IPAddresses = append(template.IPAddresses, ip)\n\t\t} else {\n\t\t\ttemplate.DNSNames = append(template.DNSNames, san)\n\t\t}\n\t}\n\n\tvar caPrivateKey *PrivateKey\n\tvar signer *x509.Certificate\n\tif !template.IsCA {\n\t\tvar err error\n\t\tcaCertificate, caPrivateKey, err = keystore.FindPrimaryKeypair(ctx, request.Signer)\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, err\n\t\t}\n\t\tif caPrivateKey == nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"ca key for %q was not found; cannot issue certificates\", request.Signer)\n\t\t}\n\t\tif caCertificate == nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"ca certificate for %q was not found; cannot issue certificates\", request.Signer)\n\t\t}\n\t\tsigner = caCertificate.Certificate\n\t}\n\n\tprivateKey := request.PrivateKey\n\tif request.PublicKey != nil {\n\t\ttemplate.PublicKey = request.PublicKey\n\t} else if privateKey == nil {\n\t\tvar err error\n\t\tprivateKey, err = GeneratePrivateKey()\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, err\n\t\t}\n\t}\n\n\tif request.Validity != 0 {\n\t\ttemplate.NotAfter = time.Now().Add(request.Validity).UTC()\n\t}","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/issue.go#L111-L147","documentation":"Companion to error 1564: FindPrimaryKeypair returned a CA keypair whose certificate is nil. Without the CA certificate, issued certificates would lack a proper issuer, so IssueCert rejects the request.","triggerScenarios":"Issuing with request.Signer pointing to a CA keyset that holds the private key but no certificate — e.g. partial import where only the key was written, or the cert entry was deleted/corrupted.","commonSituations":"Manual editing of the state-store keyset, failed CA rotation leaving a half-written keypair, or keystore migration losing the certificate half.","solutions":["Re-import or restore the CA certificate into the keyset for the named signer.","Recreate the CA keypair entirely and re-run installPKI if the certificate is unrecoverable.","Verify the keyset contents with kops toolbox before issuing certificates."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cert, key, err := keystore.FindPrimaryKeypair(ctx, signer)\nif err != nil { return err }\nif cert == nil {\n    return fmt.Errorf(\"CA %s certificate missing; restore keyset first\", signer)\n}","typeGuard":"func caReady(kp *pki.Keypair) bool {\n    return kp != nil && kp.Certificate != nil && kp.PrivateKey != nil\n}","tryCatchPattern":"if err := issueCert(...); err != nil {\n    if strings.Contains(err.Error(), \"ca certificate for\") {\n        // re-import CA cert or recreate CA, then retry\n    }\n    return err\n}","preventionTips":["Verify both halves of the CA keypair exist before issuance","Use atomic keyset writes during CA rotation","Audit the state-store pki directory after migrations"],"tags":["pki","ca","keystore","missing-certificate"],"backgroundTag":"missing-ca-certificate","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}