{"record":{"id":"ae0e235bf210bd4e","repo":"kubernetes/kops","slug":"error-creating-certificate-v-ae0e23","errorCode":null,"errorMessage":"error creating certificate: %v","messagePattern":"error creating certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":224,"sourceCode":"\t\tif len(subjectPkix.ToRDNSequence()) == 0 {\n\t\t\treturn fmt.Errorf(\"subject name was empty for SSL keypair %q\", *e.Name)\n\t\t}\n\n\t\tsigner := fi.CertificateIDCA\n\t\tif e.Signer != nil {\n\t\t\tsigner = fi.ValueOf(e.Signer.Name)\n\t\t}\n\n\t\treq := pki.IssueCertRequest{\n\t\t\tSigner:         signer,\n\t\t\tType:           e.Type,\n\t\t\tSubject:        *subjectPkix,\n\t\t\tAlternateNames: e.AlternateNames,\n\t\t}\n\n\t\tkeyset, err := CreateKeyset(ctx, c.T.Keystore, name, req)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating certificate: %v\", err)\n\t\t}\n\n\t\tif err := e.setResources(keyset); err != nil {\n\t\t\treturn fmt.Errorf(\"error setting resources: %v\", err)\n\t\t}\n\n\t\t// Make double-sure it round-trips\n\t\tif roundtrip, err := c.T.Keystore.FindKeyset(ctx, name); err != nil {\n\t\t\treturn err\n\t\t} else if roundtrip == nil {\n\t\t\treturn fmt.Errorf(\"unable to find created certificate %q: %w\", name, err)\n\t\t}\n\n\t\tklog.V(8).Infof(\"created certificate with subject %v\", subjectPkix)\n\t}\n\n\t// TODO: Check correct subject / flags\n","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L206-L242","documentation":"Render creates the new keypair by calling CreateKeyset, which looks up any existing keyset, issues a certificate via pki.IssueCert (signed by the CA identified by the signer keypair name), and stores the result via keystore.StoreKeyset. Any failure inside this pipeline — signing errors, CA keypair not found, keystore write failures — is wrapped as 'error creating certificate'.","triggerScenarios":"Render with createCertificate=true where CreateKeyset fails: the signer keyset (usually 'kubernetes-ca' or the referenced e.Signer name) is missing, pki.IssueCert fails (unsupported key type, bad request), or keystore.StoreKeyset cannot persist (state-store backend error, permissions, network).","commonSituations":"CA keypair deleted from the state store so there is nothing to sign with; S3/GCS state store unreachable or credentials expired; concurrent updates corrupting the keystore; rotating a CA without regenerating dependent keypairs.","solutions":["Ensure the signer CA keypair exists: `kops get secrets keypair kubernetes-ca` (recreate/rotate the CA if missing)","Verify state store connectivity and credentials (try `kops get cluster` against the same store)","Fix keystore write permissions / retry if a transient backend error occurred","Run `kops update cluster` again after fixing; if a partial keyset was written, delete and regenerate it"],"exampleFix":"// before: 'kubernetes-ca' missing in state store\n// after\nkops toolbox pki ... # or restore CA keyset, then\nkops update cluster --yes","handlingStrategy":"retry","validationCode":"if _, err := keystore.FindKeyset(ctx, signerName); err != nil || keystore == nil { return fmt.Errorf(\"signer keyset %q must exist before issuing\", signerName) }","typeGuard":null,"tryCatchPattern":"if err != nil { if strings.Contains(err.Error(), \"error creating certificate\") && isTransient(err) { time.Sleep(backoff); return retry() } return err }","preventionTips":["Verify state store connectivity/credentials before `kops update cluster --yes`","Never delete CA keypairs without planning rotation","Run updates single-writer to avoid keystore races"],"tags":["pki","keystore","certificate-issuance"],"backgroundTag":"certificate-issuance-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}