{"record":{"id":"c155187db1169306","repo":"kubernetes/kops","slug":"failed-to-serialize-public-key-to-der-format-v","errorCode":null,"errorMessage":"failed to serialize public key to DER format: %v","messagePattern":"failed to serialize public key to DER format: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/issuerdiscovery.go","lineNumber":199,"sourceCode":"\t}\n}\n\nfunc (o *OIDCKeys) Open() (io.Reader, error) {\n\tkeyset := o.SigningKey.Keyset()\n\tvar keys []jose.JSONWebKey\n\n\tfor _, item := range keyset.Items {\n\t\tif item.DistrustTimestamp != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif item.Certificate == nil || item.Certificate.Subject.CommonName != \"service-account\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tpublicKey := item.Certificate.PublicKey\n\t\tpublicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to serialize public key to DER format: %v\", err)\n\t\t}\n\n\t\thasher := crypto.SHA256.New()\n\t\thasher.Write(publicKeyDERBytes)\n\t\tpublicKeyDERHash := hasher.Sum(nil)\n\n\t\tkeyID := base64.RawURLEncoding.EncodeToString(publicKeyDERHash)\n\n\t\tkeys = append(keys, jose.JSONWebKey{\n\t\t\tKey:       publicKey,\n\t\t\tKeyID:     keyID,\n\t\t\tAlgorithm: string(jose.RS256),\n\t\t\tUse:       \"sig\",\n\t\t})\n\t}\n\tsort.Slice(keys, func(i, j int) bool {\n\t\treturn keys[i].KeyID < keys[j].KeyID\n\t})","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/issuerdiscovery.go#L181-L217","documentation":"This error is returned by the OIDCKeys.Open() method in kOps when building the OIDC service-account public keys document (JWKS). For each trusted service-account certificate in the signing keyset, the code serializes the certificate's public key to DER/SPKI format via x509.MarshalPKIXPublicKey; if Go's crypto/x509 package cannot marshal the key, this error is thrown. It means the public key inside the certificate is of a type or state that x509 refuses to serialize.","triggerScenarios":"Calling Open() on the OIDCKeys task when a keyset item's Certificate.PublicKey is nil, unsupported (e.g. an exotic/unregistered curve, generic crypto.Signer implementing type x509 cannot handle), or otherwise fails x509.MarshalPKIXPublicKey.","commonSituations":"A corrupted or hand-crafted CA keyset in the kOps state store; a certificate produced by an unusual key algorithm (e.g. non-RSA/ECDSA/Ed25519 key type) placed in the service-account signing keyset; state-store data tampering or partial writes from an interrupted update.","solutions":["Inspect the service-account signing keyset in the kOps state store and regenerate it with a standard RSA/ECDSA key (e.g. kops replace secrets or delete the keyset and re-run kops update).","Verify the certificate's PublicKey is non-nil and is a supported type (RSA, ECDSA, Ed25519) before it enters the keyset.","Recreate the cluster's service-account keypair with standard tooling so the DER/SPKI marshalling succeeds.","Upgrade kOps/Go toolchain if the key uses a newer algorithm unsupported by the build's x509 package."],"exampleFix":"// before: trusting arbitrary keyset items\npublicKey := item.Certificate.PublicKey\npublicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to serialize public key to DER format: %v\", err)\n}\n// after: pre-validate the key type\npublicKey := item.Certificate.PublicKey\nswitch publicKey.(type) {\ncase *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:\ndefault:\n    continue // skip unsupported service-account keys\n}\npublicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to serialize public key to DER format: %v\", err)\n}","handlingStrategy":"validation","validationCode":"for _, item := range keyset.Items {\n    if item.Certificate == nil || item.Certificate.PublicKey == nil {\n        continue // skip malformed entries before marshalling\n    }\n    switch item.Certificate.PublicKey.(type) {\n    case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:\n    default:\n        continue // unsupported key type would fail MarshalPKIXPublicKey\n    }\n}","typeGuard":"func isMarshalablePublicKey(k crypto.PublicKey) bool {\n    switch k.(type) {\n    case *rsa.PublicKey, *ecdsa.PublicKey, *ecdsa.PrivateKey, ed25519.PublicKey:\n        return true\n    default:\n        return false\n    }\n}","tryCatchPattern":null,"preventionTips":["Regenerate service-account keypairs with standard RSA/ECDSA algorithms only.","Never hand-edit or import foreign certificates into the kOps keyset.","Validate keyset contents after restoring state-store backups.","Pin a Go version whose x509 package supports your key algorithms."],"tags":["oidc","x509","crypto","der-serialization"],"backgroundTag":"public-key-serialization-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}