{"record":{"id":"cbd159c4b4bd4c5f","repo":"kubernetes/kops","slug":"marshalling-public-key-s-v","errorCode":null,"errorMessage":"marshalling public key %s: %v","messagePattern":"marshalling public key (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/ca.go","lineNumber":175,"sourceCode":"\nfunc (k *Keyset) ToPublicKeys() (string, error) {\n\tkeys := make([]string, 0, len(k.Items))\n\tfor k, item := range k.Items {\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tkeys = append(keys, k)\n\t\t}\n\t}\n\tsort.Slice(keys, func(i, j int) bool {\n\t\treturn KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)\n\t})\n\n\tbuf := new(strings.Builder)\n\tfor _, key := range keys {\n\t\titem := k.Items[key]\n\t\tif item.Certificate != nil {\n\t\t\tpublicKeyData, err := x509.MarshalPKIXPublicKey(item.Certificate.PublicKey)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"marshalling public key %s: %v\", item.Id, err)\n\t\t\t}\n\t\t\tif err = pem.Encode(buf, &pem.Block{Type: \"RSA PUBLIC KEY\", Bytes: publicKeyData}); err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"encoding public key %s: %v\", item.Id, err)\n\t\t\t}\n\t\t}\n\t}\n\treturn buf.String(), nil\n}\n\n// NewKeyset creates a Keyset.\nfunc NewKeyset(cert *pki.Certificate, privateKey *pki.PrivateKey) (*Keyset, error) {\n\tkeyset := &Keyset{\n\t\tItems: map[string]*KeysetItem{},\n\t}\n\t_, err := keyset.AddItem(cert, privateKey, true)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/ca.go#L157-L193","documentation":"Keyset.ToPublicKeys marshals each keyset item's certificate public key with x509.MarshalPKIXPublicKey into PKIX DER form. If Go's x509 parser rejects the key type/data, it returns 'marshalling public key %s: %v' with the item id — the certificate is loadable but its embedded public key cannot be represented in PKIX (e.g. unsupported algorithm).","triggerScenarios":"Keyset.ToPublicKeys: item.Certificate.PublicKey holds a key type MarshalPKIXPublicKey cannot handle (nil PublicKey, DSA/ECDSA-with-odd-params, or a certificate parsed with an unexpected field).","commonSituations":"Certificates generated by non-Go tooling with exotic algorithms; a certificate whose PublicKey wasn't populated because parsing partially failed upstream; legacy CAs using algorithms Go dropped support for.","solutions":["Check the item id in the message and inspect the certificate's algorithm: openssl x509 -text | grep -A2 'Public Key Algorithm'.","Re-issue the certificate with a supported key type (RSA 2048+ or ECDSA P-256/P-384).","Rotate the affected keyset item so a standards-compliant cert becomes primary.","Upgrade/downgrade Go (x509 algorithm support changes between Go versions) if the cert is intentionally unusual.","Verify the cert parses fully in Go before storing it in the keyset."],"exampleFix":"// before: storing an exotic-algorithm cert in the keyset\n// after: re-issue with a supported key\nopenssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -subj \"/CN=kops-ca\"","handlingStrategy":"validation","validationCode":"// reject unsupported key algorithms before storing/using a certificate\n$ openssl x509 -in cert.pem -noout -text | grep \"Public Key Algorithm\"\n# accept only: rsaEncryption, id-ecPublicKey (P-256/P-384/P-521), ED25519","typeGuard":"function isSupportedAlgorithm(alg: string): boolean {\n  return [\"rsaEncryption\", \"id-ecPublicKey\", \"ED25519\"].includes(alg)\n}","tryCatchPattern":"try {\n  const pemKeys = keyset.toPublicKeys()\n} catch (e) {\n  if (/marshalling public key/.test(e.message)) {\n    const itemId = e.message.match(/marshalling public key (\\S+):/)?.[1]\n    console.error(\"unsupported/invalid public key on item:\", itemId)\n    // re-issue the cert with RSA/ECDSA and rotate the item\n  }\n  throw e\n}","preventionTips":["Issue certificates with RSA-2048+ or ECDSA P-256/P-384 only.","Check Go version notes for x509 algorithm support changes.","Pre-validate certs with openssl before adding to keysets.","Rotate legacy CAs using exotic algorithms."],"tags":["pki","x509","keyset"],"backgroundTag":"public-key-marshalling-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}