{"record":{"id":"c4c521c07347203e","repo":"gravitational/teleport","slug":"not-a-ca-certificate-isca-false","errorCode":null,"errorMessage":"not a CA certificate (IsCA=false)","messagePattern":"not a CA certificate \\(IsCA=false\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":347,"sourceCode":"\tcert *x509.Certificate,\n) error {\n\t// Trace not used on purpose. Errors are trace-wrapped up in the chain.\n\tcertClusterName, err := tlsca.ClusterName(cert.Subject)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cluster name: %w\", err)\n\t}\n\tif certClusterName != clusterName {\n\t\treturn fmt.Errorf(\n\t\t\t\"incorrect cluster name %q (expected %q)\",\n\t\t\tcertClusterName,\n\t\t\tclusterName,\n\t\t)\n\t}\n\n\t// Verify certificate constraints.\n\tswitch {\n\tcase !cert.IsCA:\n\t\treturn errors.New(\"not a CA certificate (IsCA=false)\")\n\tcase !cert.BasicConstraintsValid:\n\t\treturn errors.New(\"basic constraints not valid (BasicConstraintsValid=false)\")\n\tcase cert.KeyUsage&x509.KeyUsageCertSign == 0:\n\t\t// Usage names per Go 1.26.1.\n\t\t// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23\n\t\treturn errors.New(\"missing KeyUsage keyCertSign\")\n\tcase cert.KeyUsage&x509.KeyUsageCRLSign == 0:\n\t\treturn errors.New(\"missing KeyUsage cRLSign\")\n\tcase cert.NotBefore.After(cert.NotAfter):\n\t\treturn errors.New(\"NotBefore > NotAfter\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":329,"sourceCodeEnd":362,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L329-L362","documentation":"validateOverrideCertificate enforces that an override certificate is a usable certificate authority. A certificate whose IsCA flag is false cannot sign or issue other certificates, so the library refuses it. This is the first constraint in the check switch in lib/subca/parsed.go.","triggerScenarios":"Passing a leaf/end-entity certificate (e.g. a server or client TLS cert) as the CA override certificate to ValidateAndParseCAOverride.","commonSituations":"Grabbing the wrong cert from a PEM bundle (leaf instead of CA); using a publicly trusted TLS server cert as an intermediate; generating certificates without the CA basic constraint.","solutions":["Use an actual CA certificate (one with CA:TRUE basic constraint) as the override certificate.","If you intended a leaf cert, locate its issuing CA and use that instead.","If the cert should be a CA, re-issue it with IsCA true and BasicConstraintsValid true via your CA tooling."],"exampleFix":"// before\n$ openssl x509 -in leaf.crt -text  # X509v3 Basic Constraints: CA:FALSE\n// after\n$ openssl req -x509 -newkey rsa:2048 -nodes \\\n    -keyout ca.key -out ca.crt -subj \"/CN=My SubCA\" \\\n    -addext \"basicConstraints=critical,CA:TRUE\" -days 3650","handlingStrategy":"validation","validationCode":"cert, err := x509.ParseCertificate(der)\nif err != nil { return err }\nif !cert.IsCA { return errors.New(\"override cert must have IsCA=true\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'openssl x509 -text' and confirm CA:TRUE before using a cert as a CA override.","Keep CA and leaf certificates in clearly separated files/directories.","Fail fast in deployment scripts by pre-parsing the override certificate."],"tags":["x509","certificate","ca","validation"],"backgroundTag":"certificate-not-a-ca","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}