{"record":{"id":"e8533722c65f1398","repo":"kubernetes/kops","slug":"error-creating-certificate-w","errorCode":null,"errorMessage":"error creating certificate: %w","messagePattern":"error creating certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/challenge_client.go","lineNumber":55,"sourceCode":"}\n\nfunc NewChallengeClient(keystore pki.Keystore) (*ChallengeClient, error) {\n\treturn &ChallengeClient{\n\t\tkeystore: keystore,\n\t}, nil\n}\n\nfunc (c *ChallengeClient) getClientCertificate(ctx context.Context, clusterName string) (*tls.Certificate, error) {\n\tsubject := challengeKopsControllerSubject(clusterName)\n\n\tcertificate, privateKey, _, err := pki.IssueCert(ctx, &pki.IssueCertRequest{\n\t\tValidity: 1 * time.Hour,\n\t\tSigner:   fi.CertificateIDCA,\n\t\tType:     \"client\",\n\t\tSubject:  subject,\n\t}, c.keystore)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating certificate: %w\", err)\n\t}\n\n\t// TODO: Caching and rotation\n\tclientCertificate := &tls.Certificate{\n\t\tPrivateKey:  privateKey.Key,\n\t\tCertificate: [][]byte{certificate.Certificate.Raw},\n\t\tLeaf:        certificate.Certificate,\n\t}\n\treturn clientCertificate, nil\n}\n\nfunc (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, bootstrapRequest *nodeup.BootstrapRequest) error {\n\tchallenge := bootstrapRequest.Challenge\n\n\tif challenge == nil {\n\t\treturn fmt.Errorf(\"challenge not set\")\n\t}\n\tif challenge.ChallengeID == \"\" {","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/challenge_client.go#L37-L73","documentation":"getClientCertificate wraps a failure from the keystore-backed certificate creation (BuildTaskCertificate-style issuance signed by the cluster CA, fi.CertificateIDCA). It means the node challenge client could not obtain its client TLS certificate, typically because the keystore is unreachable or the CA is missing/misconfigured.","triggerScenarios":"DoCallbackChallenge -> getClientCertificate issues a certificate with Signer: fi.CertificateIDCA from c.keystore; the keystore store (e.g. S3/state store) errors on read/write, or the CA key/certificate is absent or corrupt.","commonSituations":"State store (S3 bucket) credentials missing or bucket unreachable from the node; cluster CA not yet created; permissions on the keystore denying the read of the CA; cluster name mismatch pointing at the wrong state-store path.","solutions":["Check the wrapped error (%w) to see whether it's a keystore access error or CA lookup failure","Verify the kops state store is reachable and credentials permit reading the cluster CA (kops get cluster --state <store>)","Ensure `kops update cluster`/createphase ran so the CA exists in the keystore","Confirm the cluster name used by the node matches the keystore path where the CA lives"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// before starting bootstrap, confirm CA access\n_, err := keystore.FindKeystoreCert(fi.CertificateIDCA)\nif err != nil {\n  return fmt.Errorf(\"cluster CA not readable from keystore: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"cert, err := getClientCertificate(ctx)\nif err != nil {\n  return fmt.Errorf(\"could not obtain client certificate: %w\", err)\n}","preventionTips":["Verify state-store reachability and credentials from the node before bootstrapping","Ensure the cluster CA exists (run kops update/create phases)","Confirm the cluster name resolves to the correct keystore path"],"tags":["tls","keystore","certificate","challenge"],"backgroundTag":"certificate-issuance-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}