{"record":{"id":"d8a2d560af507e05","repo":"kubernetes/kops","slug":"error-issuing-certificate-v","errorCode":null,"errorMessage":"error issuing certificate: %v","messagePattern":"error issuing certificate: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":220,"sourceCode":"\tvar cert *pki.Certificate\n\tif options.CertPath == \"\" {\n\t\tif privateKey == nil {\n\t\t\tprivateKey, err = pki.GeneratePrivateKey()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error generating private key: %v\", err)\n\t\t\t}\n\t\t}\n\n\t\tserial := pki.BuildPKISerial(time.Now().UnixNano())\n\t\treq := pki.IssueCertRequest{\n\t\t\tType:       \"ca\",\n\t\t\tSubject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},\n\t\t\tSerial:     serial,\n\t\t\tPrivateKey: privateKey,\n\t\t}\n\t\tcert, _, _, err = pki.IssueCert(ctx, &req, nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error issuing certificate: %v\", err)\n\t\t}\n\t} else {\n\t\toptions.CertPath = utils.ExpandPath(options.CertPath)\n\t\tcertBytes, err := os.ReadFile(options.CertPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading user provided cert %q: %v\", options.CertPath, err)\n\t\t}\n\n\t\tcert, err = pki.ParsePEMCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading certificate %q: %v\", options.CertPath, err)\n\t\t}\n\t}\n\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tvar item *fi.KeysetItem\n\tif os.IsNotExist(err) || (err == nil && keyset == nil) {\n\t\tif options.Primary {","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L202-L238","documentation":"This error wraps a failure from pki.IssueCert() when `kops create keypair` self-signs a new CA certificate for the keyset. The IssueCert request (type \"ca\", subject = keyset name, the generated private key) could not be processed into a certificate. The wrapped %v holds the underlying crypto/x509 cause.","triggerScenarios":"Calling `kops create keypair` without --cert so a new CA cert is issued via pki.IssueCert(ctx, &req, nil), and the signing/issuance step returns an error.","commonSituations":"Keypair creation for a cluster CA on a broken or mismatched kOps build; unexpected pki library failure while signing the just-generated key.","solutions":["Read the wrapped error (%v) for the precise x509/crypto cause.","Retry the command; issuance failures here are rarely user-caused.","Verify the private key generated/parsed earlier is valid.","Upgrade kOps to the latest patch release and retry."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error issuing certificate\") {\n    // inspect wrapped cause, regenerate the private key, retry once\n}","preventionTips":["Keep private key generation and issuance in the same command run.","Retry once on transient failures.","Upgrade kOps if the wrapped cause indicates a library bug."],"tags":["pki","certificate","x509"],"backgroundTag":"certificate-issuance-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}