{"record":{"id":"9cd9d2fac47b037c","repo":"kubernetes/kops","slug":"error-generating-certificate-serial-number-s","errorCode":null,"errorMessage":"error generating certificate serial number: %s","messagePattern":"error generating certificate serial number: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/csr.go","lineNumber":69,"sourceCode":"\n\tif template.PublicKey == nil {\n\t\treturn nil, fmt.Errorf(\"PublicKey not set, and cannot be determined from %T\", privateKey)\n\t}\n\n\tnow := time.Now()\n\tif template.NotBefore.IsZero() {\n\t\ttemplate.NotBefore = now.Add(time.Hour * -48)\n\t}\n\n\tif template.NotAfter.IsZero() {\n\t\ttemplate.NotAfter = now.Add(time.Hour * 10 * 365 * 24)\n\t}\n\n\tif template.SerialNumber == nil {\n\t\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\t\tserialNumber, err := crypto_rand.Int(crypto_rand.Reader, serialNumberLimit)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error generating certificate serial number: %s\", err)\n\t\t}\n\t\ttemplate.SerialNumber = serialNumber\n\t}\n\tvar parent *x509.Certificate\n\tif signer != nil {\n\t\tparent = signer\n\t} else {\n\t\tparent = template\n\t\tsignerPrivateKey = privateKey\n\t}\n\n\tif template.KeyUsage == 0 {\n\t\ttemplate.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment\n\t}\n\n\tif template.ExtKeyUsage == nil && !template.IsCA {\n\t\ttemplate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}\n\t}","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/csr.go#L51-L87","documentation":"signNewCertificate generates a random 128-bit serial number via crypto/rand when the template has none; this error wraps crypto_rand.Int failure, meaning the system CSPRNG failed (effectively only on catastrophic OS-level entropy errors). Certificate issuance cannot proceed without a serial.","triggerScenarios":"Thrown at pkg/pki/csr.go:69 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check OS entropy availability (/dev/urandom) and system health","Retry certificate issuance; this is typically transient","Investigate the underlying crypto/rand error reported in the message"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}