{"record":{"id":"d01a0854e081e977","repo":"kubernetes/kops","slug":"error-parsing-certificate-v-d01a08","errorCode":null,"errorMessage":"error parsing certificate: %v","messagePattern":"error parsing certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/csr.go","lineNumber":97,"sourceCode":"\t}\n\n\tif template.KeyUsage == 0 {\n\t\ttemplate.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment\n\t}\n\n\tif template.ExtKeyUsage == nil && !template.IsCA {\n\t\ttemplate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}\n\t}\n\t// c.SignatureAlgorithm  = do we want to override?\n\n\tcertificateData, err := x509.CreateCertificate(crypto_rand.Reader, template, parent, template.PublicKey, signerPrivateKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating certificate: %v\", err)\n\t}\n\n\tcert, err := x509.ParseCertificate(certificateData)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t}\n\n\tc := &Certificate{\n\t\tSubject:     cert.Subject,\n\t\tIsCA:        cert.IsCA,\n\t\tCertificate: cert,\n\t\tPublicKey:   cert.PublicKey,\n\t}\n\n\treturn c, nil\n}\n","sourceCodeStart":79,"sourceCodeEnd":109,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/csr.go#L79-L109","documentation":"signNewCertificate successfully created a self-signed or CA-signed certificate via the signer, but x509.ParseCertificate failed on the DER bytes returned. This means the signer/backend produced bytes that are not a valid DER-encoded X.509 certificate, which should never happen with Go's crypto/x509 CreateCertificate.","triggerScenarios":"Calling IssueCert/signNewCertificate when the underlying keypair store returns corrupt or non-DER certificateData bytes to parse.","commonSituations":"Corrupted CA certificate in a file-based or FS keystores (truncated file, wrong encoding such as PEM bytes passed instead of DER), or a custom keystore implementation returning malformed certificate bytes.","solutions":["Check the CA certificate stored in the keystore is valid PEM/DER and re-create the CA (kops replace / delete and re-export the keypair).","Inspect the keypair files under the keyset for truncation or wrong encoding (PEM vs DER) and fix the keystore contents.","If using a custom keystore implementation, ensure FindPrimaryKeypair returns raw DER certificate bytes.","Upgrade kOps in case of a keystore serialization bug in your version."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// verify CA cert parses before issuing\nif caCert != nil && caCert.Certificate == nil {\n    return fmt.Errorf(\"CA certificate bytes missing\")\n}\nif _, err := x509.ParseCertificate(caCert.Certificate); err != nil {\n    return fmt.Errorf(\"CA certificate corrupt: %w\", err)\n}","typeGuard":"func hasValidCert(kp *pki.Keypair) bool {\n    return kp != nil && kp.Certificate != nil\n}","tryCatchPattern":"cert, err := issueCert(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"error parsing certificate\") {\n        // recreate CA keypair before retrying\n    }\n    return err\n}","preventionTips":["Never hand-edit keyset files in the state store","Validate CA keysets after any backup restore","Use kops toolbox to inspect keypairs before issuing certs"],"tags":["pki","x509","certificate-parsing"],"backgroundTag":"x509-certificate-parse-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}