gravitational/teleport · error

nil certificate override

Error message

nil certificate override

What it means

validateCertificateOverride rejects a subCA certificate override CR (subcav1.CertificateOverride) that is nil. ValidateAndParseCAOverride parses and validates overrides before they are applied to subordinate CA issuance; a nil override carries no certificate or public key and cannot be validated, so it fails fast with this plain error.

Source

Thrown at lib/subca/parsed.go:225

		}
		seenPublicKeys[parsedCO.PublicKey] = struct{}{}

		parsedOverrides[i] = parsedCO
	}

	return &ParsedCertAuthorityOverride{
		CAOverride:           resource,
		CertificateOverrides: parsedOverrides,
	}, nil
}

func validateCertificateOverride(
	clusterName string,
	co *subcav1.CertificateOverride,
) (_ *ParsedCertificateOverride, fieldName string, _ error) {
	// Trace not used on purpose. Errors are trace-wrapped up in the chain.
	if co == nil {
		return nil, "", errors.New("nil certificate override")
	}

	// Certificate.
	var cert *x509.Certificate
	var wantPublicKey string
	if co.GetCertificate() != "" {
		var err error
		cert, err = ParseCertificateOverrideCertificate(co.GetCertificate())
		if err != nil {
			return nil, "certificate", err
		}
		if err := validateOverrideCertificate(clusterName, cert); err != nil {
			return nil, "certificate", err
		}
		wantPublicKey = HashCertificatePublicKey(cert)
	}

	// PublicKey.

View on GitHub (pinned to 1283425b60)

Solutions

1. Ensure the SubCA spec includes a certificate_override with either a certificate or a public key before calling ValidateAndParseCAOverride
2. Check for nil before calling and return a clear config error identifying the missing field

Example fix

// before
parsed, field, err := ValidateAndParseCAOverride(clusterName, spec.Override)
// after
if spec.Override == nil {
    return trace.BadParameter("subca spec requires a certificate override")
}
parsed, field, err := ValidateAndParseCAOverride(clusterName, spec.Override)

if override == nil {
    return trace.BadParameter("certificate override must be set with a certificate or public key")
}
parsed, _, err := subca.ValidateAndParseCAOverride(clusterName, override)
if err != nil { return trace.Wrap(err) }

func hasOverride(o *subcav1.CertificateOverride) bool {
    return o != nil && (o.GetCertificate() != "" || o.GetPublicKey() != "")
}

parsed, field, err := ValidateAndParseCAOverride(clusterName, co)
if err != nil {
    return trace.Wrap(err, "invalid certificate override (field %q)", field)
}

When it happens

Trigger: Passing a nil *subcav1.CertificateOverride to ValidateAndParseCAOverride — typically when the override spec in the SubCA resource is absent/unset but the code path unconditionally validates it.

Common situations: A YAML/JSON spec for a subordinate CA omits the certificate override block while code expects it present; resource deserialization leaves the field nil.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• certificate required
• invalid public key
• certificate or public key required
• chain not allowed with an empty certificate
• not a CA certificate (IsCA=false)

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/900f4873ca8027c4. Report an issue: GitHub.