{"record":{"id":"c80ffdffe9134bde","repo":"kubernetes/kops","slug":"fetching-intermediate-certificates-w","errorCode":null,"errorMessage":"fetching intermediate certificates: %w","messagePattern":"fetching intermediate certificates: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":219,"sourceCode":"\n\t// Verify using only the certificates embedded in the PKCS7 structure; if that succeeds, the signer\n\t// is trusted. If it fails but the PKCS7 already embeds a cert matching the signer's issuer, the\n\t// chain is genuinely broken (not just missing an intermediate), so fail fast instead of fetching.\n\tchainErr := verifySignerCertChain(signer, p7.Certificates, rootCertPool, x509.NewCertPool())\n\tif chainErr == nil {\n\t\tklog.V(2).Infof(\"PKCS7 certificate chain verified with embedded certificates for signer issuer %q\", signer.Issuer)\n\t\treturn data, nil\n\t}\n\tfor _, cert := range p7.Certificates {\n\t\tif validateFetchedIntermediateForSigner(signer, cert) == nil {\n\t\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain with embedded intermediates: %w\", chainErr)\n\t\t}\n\t}\n\n\tklog.V(4).Infof(\"Resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\tintermediateCerts, err := fetchIntermediates(signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fetching intermediate certificates: %w\", err)\n\t}\n\tif err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {\n\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain: %w\", err)\n\t}\n\tklog.V(4).Infof(\"PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\n\treturn data, nil\n}\n\n// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its\n// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata\n// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call\n// before triggering intermediate certificate fetches.\nfunc parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {\n\tif signature == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"empty PKCS7 signature\")\n\t}\n","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L201-L237","documentation":"Fetching the intermediate certificates (from the Microsoft PKI AIA URLs, subject to allowlist and caching) failed while trying to complete the signer's chain after embedded certificates were insufficient. A network or upstream PKI endpoint failure.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:219 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check outbound network access to the Microsoft PKI hosts from the control plane","Retry; AIA fetches are cached and transient failures clear on the next attempt","Confirm the allowlisted Microsoft intermediate cert base URL is still valid (PKI endpoints occasionally move)"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}