{"record":{"id":"9b42ca4b6791fb59","repo":"kubernetes/kops","slug":"subject-name-was-empty-for-ssl-keypair-q","errorCode":null,"errorMessage":"subject name was empty for SSL keypair %q","messagePattern":"subject name was empty for SSL keypair %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":207,"sourceCode":"\t\t\tcreateCertificate = true\n\t\t\tklog.Infof(\"creating certificate %q as Type has changed (actual=%v, expected=%v)\", name, a.Type, e.Type)\n\t\t} else if a.LegacyFormat {\n\t\t\tchangeStoredFormat = true\n\t\t} else {\n\t\t\tklog.Warningf(\"Ignoring changes in key: %v\", fi.DebugAsJsonString(changes))\n\t\t}\n\t}\n\n\tif createCertificate {\n\t\tklog.V(2).Infof(\"Creating PKI keypair %q\", name)\n\n\t\tsubjectPkix, err := parsePkixName(e.Subject)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error parsing Subject: %v\", err)\n\t\t}\n\n\t\tif len(subjectPkix.ToRDNSequence()) == 0 {\n\t\t\treturn fmt.Errorf(\"subject name was empty for SSL keypair %q\", *e.Name)\n\t\t}\n\n\t\tsigner := fi.CertificateIDCA\n\t\tif e.Signer != nil {\n\t\t\tsigner = fi.ValueOf(e.Signer.Name)\n\t\t}\n\n\t\treq := pki.IssueCertRequest{\n\t\t\tSigner:         signer,\n\t\t\tType:           e.Type,\n\t\t\tSubject:        *subjectPkix,\n\t\t\tAlternateNames: e.AlternateNames,\n\t\t}\n\n\t\tkeyset, err := CreateKeyset(ctx, c.T.Keystore, name, req)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating certificate: %v\", err)\n\t\t}","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L189-L225","documentation":"parsePkixName can return an empty pkix.Name without error (e.g. if the subject produces no RDNs, or only whitespace tokens). Since a certificate with an empty subject is invalid, Render explicitly rejects it with 'subject name was empty for SSL keypair <name>'. This is a sanity check immediately after parsing succeeds.","triggerScenarios":"Render with createCertificate=true where parsePkixName(e.Subject) succeeds but subjectPkix.ToRDNSequence() is empty — e.g. an empty Subject string or a subject that yields no CN/O values.","commonSituations":"Cluster spec field for a keypair subject left blank; subject built programmatically from an empty/missing config value; edge cases where the subject string parses but maps to no recognized RDN.","solutions":["Set a valid Subject containing at least a CN, e.g. 'CN=<name>,O=kops'","Find why the spec value is empty (missing config field, unset variable) and populate it","Validate the subject string non-empty before running kops update"],"exampleFix":"// before\nkeypair.Subject = cfg.TLSSubject // \"\"\n// after\nkeypair.Subject = \"CN=apiserver-api,O=kops\"","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(subject) == \"\" { return errors.New(\"keypair subject must be non-empty, e.g. CN=apiserver,O=kops\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include at least CN in keypair subjects","Add spec validation that subject fields are non-empty","Trace template/config values feeding Subject to catch empty sources early"],"tags":["pki","validation","subject-parse","x509"],"backgroundTag":"invalid-certificate-subject","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}