{"record":{"id":"a1505b004d0e56d1","repo":"kubernetes/kops","slug":"error-loading-certificate-s-s-v","errorCode":null,"errorMessage":"error loading certificate %s/%s: %v","messagePattern":"error loading certificate (.+?)/(.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/clientset_castore.go","lineNumber":89,"sourceCode":"\tname := o.Name\n\n\tkeyset := &Keyset{\n\t\tItems: make(map[string]*KeysetItem),\n\t}\n\n\tfor _, key := range o.Spec.Keys {\n\t\tki := &KeysetItem{\n\t\t\tId: key.Id,\n\t\t}\n\t\tif key.DistrustTimestamp != nil {\n\t\t\tdistrustTimestamp := key.DistrustTimestamp.Time\n\t\t\tki.DistrustTimestamp = &distrustTimestamp\n\t\t}\n\t\tif len(key.PublicMaterial) != 0 {\n\t\t\tcert, err := pki.ParsePEMCertificate(key.PublicMaterial)\n\t\t\tif err != nil {\n\t\t\t\tklog.Warningf(\"key public material was %s\", key.PublicMaterial)\n\t\t\t\treturn nil, fmt.Errorf(\"error loading certificate %s/%s: %v\", name, key.Id, err)\n\t\t\t}\n\t\t\tki.Certificate = cert\n\t\t}\n\n\t\tif len(key.PrivateMaterial) != 0 {\n\t\t\tprivateKey, err := pki.ParsePEMPrivateKey(key.PrivateMaterial)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading private key %s/%s: %v\", name, key.Id, err)\n\t\t\t}\n\t\t\tki.PrivateKey = privateKey\n\t\t}\n\n\t\tkeyset.Items[key.Id] = ki\n\t}\n\n\tkeyset.Primary = keyset.Items[FindPrimary(o).Id]\n\n\treturn keyset, nil","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/clientset_castore.go#L71-L107","documentation":"parseKeyset decodes each keyset item's public material with pki.ParsePEMCertificate. If the stored bytes are not a valid PEM certificate, the item cannot be loaded and the whole keyset parse fails with 'error loading certificate <name>/<id>: <underlying>'. Raised in upup/pkg/fi/clientset_castore.go:89 from loadKeyset and ListKeysets.","triggerScenarios":"A kops Keyset API object whose key.PublicMaterial contains corrupt, truncated, empty-but-nonzero, or non-PEM bytes, so ParsePEMCertificate returns an error.","commonSituations":"Manual edits to Keyset objects in the cluster registry; data corruption after interrupted writes; exporting/importing keysets across kOps versions that changed the material encoding.","solutions":["Inspect key.PublicMaterial (the warning log prints it) and fix or re-encode it as a valid PEM CERTIFICATE block","Re-issue/rotate the keypair for that keyset (e.g. 'kops export kubecfg'/'kops replace' or re-run create keypair) so valid material is stored","Restore the Keyset object from a backup or delete the corrupt item and re-add it"],"exampleFix":"// corrupt material\nkey.PublicMaterial = []byte(\"not-a-pem\")\n// after: store valid PEM\nkey.PublicMaterial = pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: derBytes})","handlingStrategy":"try-catch","validationCode":"for _, b := range [][]byte{item.PublicMaterial} {\n\tif !pemHasBlock(b, \"CERTIFICATE\") {\n\t\treturn fmt.Errorf(\"keyset item public material is not PEM CERTIFICATE\")\n\t}\n}\nif _, err := pki.ParsePEMCertificate(item.PublicMaterial); err != nil {\n\treturn fmt.Errorf(\"certificate will fail to load: %w\", err)\n}","typeGuard":"func isPEMCertificate(b []byte) bool {\n\tblock, _ := pem.Decode(b)\n\treturn block != nil && block.Type == \"CERTIFICATE\"\n}","tryCatchPattern":"keyset, err := store.FindKeyset(ctx, name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"error loading certificate\") {\n\t\t// quarantine/rotate the corrupted keyset item\n\t}\n\treturn err\n}","preventionTips":["Never hand-edit Keyset material YAML; use kops commands to rotate keys","Validate PEM output of external tools before importing","Back up keysets before migration or version upgrades"],"tags":["go","ca","pem","certificate","deserialization"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}