{"record":{"id":"c0d5fc753236378c","repo":"kubernetes/kops","slug":"unrecognized-certificate-option-v","errorCode":null,"errorMessage":"unrecognized certificate option: %v","messagePattern":"unrecognized certificate option: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/issue.go","lineNumber":84,"sourceCode":"// IssueCert issues a certificate, either a self-signed CA or from a CA in a keystore.\nfunc IssueCert(ctx context.Context, request *IssueCertRequest, keystore Keystore) (issuedCertificate *Certificate, issuedKey *PrivateKey, caCertificate *Certificate, err error) {\n\tcertificateType := request.Type\n\tif expanded, found := wellKnownCertificateTypes[certificateType]; found {\n\t\tcertificateType = expanded\n\t}\n\n\ttemplate := &x509.Certificate{\n\t\tBasicConstraintsValid: true,\n\t\tIsCA:                  false,\n\t\tSerialNumber:          request.Serial,\n\t}\n\n\ttokens := strings.Split(certificateType, \",\")\n\tfor _, t := range tokens {\n\t\tif strings.HasPrefix(t, \"KeyUsage\") {\n\t\t\tku, found := parseKeyUsage(t)\n\t\t\tif !found {\n\t\t\t\treturn nil, nil, nil, fmt.Errorf(\"unrecognized certificate option: %v\", t)\n\t\t\t}\n\t\t\ttemplate.KeyUsage |= ku\n\t\t} else if strings.HasPrefix(t, \"ExtKeyUsage\") {\n\t\t\tku, found := parseExtKeyUsage(t)\n\t\t\tif !found {\n\t\t\t\treturn nil, nil, nil, fmt.Errorf(\"unrecognized certificate option: %v\", t)\n\t\t\t}\n\t\t\ttemplate.ExtKeyUsage = append(template.ExtKeyUsage, ku)\n\t\t} else if t == \"CA\" {\n\t\t\ttemplate.IsCA = true\n\t\t} else {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"unrecognized certificate option: %q\", t)\n\t\t}\n\t}\n\n\ttemplate.Subject = request.Subject\n\n\tvar alternateNames []string","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/issue.go#L66-L102","documentation":"IssueCert parses the requested certificate type as a comma-separated token list; tokens beginning with \"KeyUsage\" are mapped through parseKeyUsage, and if a token starts with KeyUsage but is not a recognized name, the option is rejected. This guards against typo'd or unsupported key-usage strings silently producing certificates with missing usages.","triggerScenarios":"Calling IssueCert with request.Type containing a token like \"KeyUsageDigitalSignture\" (typo) or \"KeyUsageWhatever\" — any token with prefix KeyUsage that parseKeyUsage cannot map.","commonSituations":"Typo in the certificate type string in cluster spec / TLS config, copying usage names not in Go's x509.KeyUsage set, or version drift where an expected usage name is unsupported.","solutions":["Correct the KeyUsage token to a supported name (e.g. KeyUsageDigitalSignature, KeyUsageKeyEncipherment, KeyUsageCertSign).","Check parseKeyUsage in pkg/pki/issue.go for the exact set of accepted usage names.","Remove the unsupported usage token if it is not needed for the certificate's role."],"exampleFix":"// before\nIssueCert(ctx, keystore, &IssueCertificateRequest{Type: \"KeyUsageDigitalSignture,ExtKeyUsageServerAuth\", ...})\n// after\nIssueCert(ctx, keystore, &IssueCertificateRequest{Type: \"KeyUsageDigitalSignature,ExtKeyUsageServerAuth\", ...})","handlingStrategy":"validation","validationCode":"func hasValidKeyUsage(certType string) bool {\n    for _, t := range strings.Split(certType, \",\") {\n        if strings.HasPrefix(t, \"KeyUsage\") && parseKeyUsage(t) == (x509.KeyUsage(0)) {\n            return false\n        }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy usage names only from parseKeyUsage's accepted list in pkg/pki/issue.go","Lint cluster spec certificate type strings","Add a unit test covering the exact Type strings you use"],"tags":["pki","certificate","key-usage","configuration"],"backgroundTag":"invalid-certificate-option","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}