{"record":{"id":"cc32d0671147ef92","repo":"gravitational/teleport","slug":"invalid-public-key","errorCode":null,"errorMessage":"invalid public key","messagePattern":"invalid public key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":246,"sourceCode":"\t// Certificate.\n\tvar cert *x509.Certificate\n\tvar wantPublicKey string\n\tif co.GetCertificate() != \"\" {\n\t\tvar err error\n\t\tcert, err = ParseCertificateOverrideCertificate(co.GetCertificate())\n\t\tif err != nil {\n\t\t\treturn nil, \"certificate\", err\n\t\t}\n\t\tif err := validateOverrideCertificate(clusterName, cert); err != nil {\n\t\t\treturn nil, \"certificate\", err\n\t\t}\n\t\twantPublicKey = HashCertificatePublicKey(cert)\n\t}\n\n\t// PublicKey.\n\tif co.GetPublicKey() != \"\" {\n\t\tif !certificateOverridePublicKeyRE.MatchString(co.GetPublicKey()) {\n\t\t\treturn nil, \"\", errors.New(\"invalid public key\")\n\t\t}\n\t\tif wantPublicKey != \"\" && NormalizePublicKey(co.GetPublicKey()) != wantPublicKey {\n\t\t\treturn nil, \"public_key\", fmt.Errorf(\"certificate public key mismatch (want %q)\", wantPublicKey)\n\t\t}\n\t}\n\n\t// Validate \"required\" fields now that we know both Certificate and PublicKey\n\t// are valid.\n\tswitch {\n\tcase co.GetDisabled() && co.GetPublicKey() == \"\" && co.GetCertificate() == \"\":\n\t\treturn nil, \"\", errors.New(\"certificate or public key required\")\n\tcase co.GetDisabled():\n\t\t// OK, determined above to have either PublicKey or Certificate.\n\tcase co.GetCertificate() == \"\":\n\t\treturn nil, \"\", errors.New(\"certificate required\")\n\t}\n\n\t// Chain.","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L228-L264","documentation":"validateCertificateOverride rejects the override's public_key when it does not match the expected PEM public key format (certificateOverridePublicKeyRE) or when an accompanying certificate is present whose public key hash differs from the supplied public_key. This guards subCA overrides against malformed or mismatched key material.","triggerScenarios":"Providing co.PublicKey that is not a valid PEM public key string, or providing both certificate and public_key where NormalizePublicKey(public_key) != HashCertificatePublicKey(cert).","commonSituations":"Copy-pasting a public key with wrong PEM headers/extra whitespace; supplying a public_key from a different certificate than the override's certificate; pasting a private key or certificate where a public key is expected.","solutions":["Provide the public key as a valid PEM-encoded PUBLIC KEY block","If both certificate and public_key are set, ensure the public key matches the certificate's key (or omit public_key and let it be derived from the certificate)","Regenerate/extract the key with openssl: openssl x509 -in cert.pem -pubkey -noout"],"exampleFix":"// before: mismatched public_key + certificate\noverride:\n  certificate: <cert A>\n  public_key: <key from cert B>\n// after: derive from certificate\noverride:\n  certificate: <cert A>","handlingStrategy":"validation","validationCode":"pub, ok := normalizePublicKeyPEM(override.GetPublicKey())\nif !ok { return trace.BadParameter(\"public_key must be PEM-encoded PUBLIC KEY\") }\nif override.GetCertificate() != \"\" {\n    cert := parseCert(t, override.GetCertificate())\n    if normalize(pub) != hashCertPub(cert) {\n        return trace.BadParameter(\"public_key does not match certificate\")\n    }\n}","typeGuard":"func publicKeyMatchesCert(certPEM, pubPEM string) bool {\n    cert, err := subca.ParseCertificatePEM(certPEM); if err != nil { return false }\n    return subca.NormalizePublicKey(pubPEM) == subca.HashCertificatePublicKey(cert)\n}","tryCatchPattern":"_, field, err := ValidateAndParseCAOverride(clusterName, co)\nif field == \"public_key\" {\n    return trace.BadParameter(\"override public_key invalid or does not match certificate\")\n}","preventionTips":["Derive public_key from the same certificate instead of pasting separately","Use openssl x509 -pubkey -noout to extract the exact PEM public key","Never paste private keys or full certs into the public_key field"],"tags":["subca","validation","public-key","x509"],"backgroundTag":"invalid-public-key","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}