{"record":{"id":"ff7704d0e3103ca5","repo":"kubernetes/kops","slug":"failed-to-parse-certificate-w","errorCode":null,"errorMessage":"failed to parse certificate: %w","messagePattern":"failed to parse certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/challenge.go","lineNumber":92,"sourceCode":"\t\t},\n\t\tNotBefore: notBefore,\n\t\tNotAfter:  notAfter,\n\n\t\tKeyUsage:              keyUsage,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},\n\t\tBasicConstraintsValid: true,\n\t}\n\n\ttemplate.DNSNames = append(template.DNSNames, serverName)\n\n\tder, err := x509.CreateCertificate(cryptorand.Reader, &template, &template, privateKey.Key.Public(), privateKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create certificate: %w\", err)\n\t}\n\n\tparsed, err := x509.ParseCertificate(der)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t}\n\ttlsCertificate := &tls.Certificate{\n\t\tPrivateKey:  privateKey.Key,\n\t\tCertificate: [][]byte{parsed.Raw},\n\t\tLeaf:        parsed,\n\t}\n\n\treturn tlsCertificate, nil\n}\n","sourceCodeStart":74,"sourceCodeEnd":102,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/challenge.go#L74-L102","documentation":"BuildChallengeServerCertificate wraps an error from x509.ParseCertificate after the certificate DER bytes were just created. Since the bytes come directly from CreateCertificate, this should be impossible in practice; if it fires, the crypto backend produced malformed DER or memory corruption/patched crypto layers are in play.","triggerScenarios":"NewChallengeServer builds the challenge certificate; x509.ParseCertificate(der) fails on freshly generated DER bytes — essentially only under a broken/patched Go crypto stack or corrupted memory.","commonSituations":"Custom Go toolchains with crypto patches; FIPS-mode builds altering encoding; observing this in stock kops strongly suggests a bug report-worthy environment problem.","solutions":["Confirm the Go toolchain is official/unpatched (go version) and rebuild kops","Check for FIPS or crypto replacement modules (e.g. boringcrypto) in the build (go env GOEXPERIMENT, build tags)","Log hex.Dump(der) and inspect whether the bytes are a plausible certificate","Report to kops with the environment details if reproducible with a stock build"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"cert, err := BuildChallengeServerCertificate(clusterName)\nif err != nil {\n  return fmt.Errorf(\"challenge server startup failed: %w\", err)\n}","preventionTips":["Use official, unpatched Go toolchains (avoid unexpected crypto replacements)","Rebuild kops with a standard toolchain if this impossible error appears","Escalate to a bug report with environment details if reproducible"],"tags":["tls","x509","certificate-parsing","challenge"],"backgroundTag":"certificate-parse-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}