{"record":{"id":"cc2778fb258b875f","repo":"kubernetes/kops","slug":"error-marshaling-ssh-public-key-v","errorCode":null,"errorMessage":"error marshaling SSH public key: %v","messagePattern":"error marshaling SSH public key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/sshkey.go","lineNumber":114,"sourceCode":"\t}\n\n\th := md5.Sum(sshPublicKey.Marshal())\n\treturn colonSeparatedHex(h[:]), nil\n}\n\n// rsaToDER gets the DER encoding of the SSH public key\n// Annoyingly, the ssh code wraps the actual crypto keys, so we have to use reflection tricks\nfunc rsaToDER(pubkey ssh.PublicKey) ([]byte, error) {\n\tvar cryptoKey crypto.PublicKey\n\tvar rsaPublicKey *rsa.PublicKey\n\n\tpubkeyValue := reflect.ValueOf(pubkey)\n\ttargetType := reflect.ValueOf(rsaPublicKey).Type()\n\trsaPublicKey = pubkeyValue.Convert(targetType).Interface().(*rsa.PublicKey)\n\tcryptoKey = rsaPublicKey\n\tder, err := x509.MarshalPKIXPublicKey(cryptoKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error marshaling SSH public key: %v\", err)\n\t}\n\treturn der, nil\n}\n","sourceCodeStart":96,"sourceCodeEnd":118,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/sshkey.go#L96-L118","documentation":"rsaToDER converts the parsed SSH RSA key to an *rsa.PublicKey and then serializes it with x509.MarshalPKIXPublicKey to produce DER bytes for the MD5 fingerprint. Failure here means Go's x509 marshaller refused the key (nil or invalid key parameters).","triggerScenarios":"MarshalPKIXPublicKey returning an error for the converted rsa.PublicKey — practically only when the key structure is invalid (zero modulus/exponent) or a Go/x509 limitation.","commonSituations":"Corrupted key blobs whose decoded numbers fail x509 validation; extremely rare with keys produced by ssh-keygen.","solutions":["Regenerate the RSA key pair with ssh-keygen and re-import","Verify the key parses with `openssl rsa -pubin -in pub.key -text -noout` equivalents","Update Go/kOps if the key uses a rarely exercised size that trips an x509 edge case"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"fp, err := pki.ComputeAWSKeyFingerprint(pubKey)\nif err != nil {\n\tif strings.Contains(err.Error(), \"error marshaling SSH public key\") {\n\t\treturn \"\", fmt.Errorf(\"key material invalid; regenerate key pair: %w\", err)\n\t}\n\treturn \"\", err\n}","preventionTips":["Regenerate rather than edit suspect RSA keys","Verify keys with openssl/ssh-keygen before ingestion","Keep Go runtime current to avoid x509 edge-case regressions"],"tags":["ssh","rsa","x509","fingerprint"],"backgroundTag":"ssh-key-fingerprint-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}