{"record":{"id":"e12fa3d6d0775ed7","repo":"kubernetes/kops","slug":"verifying-pkcs7-certificate-chain-w","errorCode":null,"errorMessage":"verifying PKCS7 certificate chain: %w","messagePattern":"verifying PKCS7 certificate chain: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":222,"sourceCode":"\t// chain is genuinely broken (not just missing an intermediate), so fail fast instead of fetching.\n\tchainErr := verifySignerCertChain(signer, p7.Certificates, rootCertPool, x509.NewCertPool())\n\tif chainErr == nil {\n\t\tklog.V(2).Infof(\"PKCS7 certificate chain verified with embedded certificates for signer issuer %q\", signer.Issuer)\n\t\treturn data, nil\n\t}\n\tfor _, cert := range p7.Certificates {\n\t\tif validateFetchedIntermediateForSigner(signer, cert) == nil {\n\t\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain with embedded intermediates: %w\", chainErr)\n\t\t}\n\t}\n\n\tklog.V(4).Infof(\"Resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\tintermediateCerts, err := fetchIntermediates(signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fetching intermediate certificates: %w\", err)\n\t}\n\tif err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {\n\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain: %w\", err)\n\t}\n\tklog.V(4).Infof(\"PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\n\treturn data, nil\n}\n\n// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its\n// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata\n// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call\n// before triggering intermediate certificate fetches.\nfunc parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {\n\tif signature == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"empty PKCS7 signature\")\n\t}\n\n\tsigBytes, err := base64.StdEncoding.DecodeString(signature)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"decoding PKCS7 signature: %w\", err)","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L204-L240","documentation":"After successfully fetching intermediate certificates, the signer certificate still failed to chain to the trusted root. The attestation is cryptographically unverifiable against the configured Microsoft root pool.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:222 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the attestation token","Verify the verifier's root pool contains the current Microsoft PKI root CAs","Update kops if Microsoft rotated its PKI"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}