gravitational/teleport · error

not a CA certificate (IsCA=false)

Error message

not a CA certificate (IsCA=false)

What it means

validateOverrideCertificate enforces that an override certificate is a usable certificate authority. A certificate whose IsCA flag is false cannot sign or issue other certificates, so the library refuses it. This is the first constraint in the check switch in lib/subca/parsed.go.

Source

Thrown at lib/subca/parsed.go:347

	cert *x509.Certificate,
) error {
	// Trace not used on purpose. Errors are trace-wrapped up in the chain.
	certClusterName, err := tlsca.ClusterName(cert.Subject)
	if err != nil {
		return fmt.Errorf("cluster name: %w", err)
	}
	if certClusterName != clusterName {
		return fmt.Errorf(
			"incorrect cluster name %q (expected %q)",
			certClusterName,
			clusterName,
		)
	}

	// Verify certificate constraints.
	switch {
	case !cert.IsCA:
		return errors.New("not a CA certificate (IsCA=false)")
	case !cert.BasicConstraintsValid:
		return errors.New("basic constraints not valid (BasicConstraintsValid=false)")
	case cert.KeyUsage&x509.KeyUsageCertSign == 0:
		// Usage names per Go 1.26.1.
		// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23
		return errors.New("missing KeyUsage keyCertSign")
	case cert.KeyUsage&x509.KeyUsageCRLSign == 0:
		return errors.New("missing KeyUsage cRLSign")
	case cert.NotBefore.After(cert.NotAfter):
		return errors.New("NotBefore > NotAfter")
	}

	return nil
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Use an actual CA certificate (one with CA:TRUE basic constraint) as the override certificate.
2. If you intended a leaf cert, locate its issuing CA and use that instead.
3. If the cert should be a CA, re-issue it with IsCA true and BasicConstraintsValid true via your CA tooling.

Example fix

// before
$ openssl x509 -in leaf.crt -text  # X509v3 Basic Constraints: CA:FALSE
// after
$ openssl req -x509 -newkey rsa:2048 -nodes \
    -keyout ca.key -out ca.crt -subj "/CN=My SubCA" \
    -addext "basicConstraints=critical,CA:TRUE" -days 3650

cert, err := x509.ParseCertificate(der)
if err != nil { return err }
if !cert.IsCA { return errors.New("override cert must have IsCA=true") }

When it happens

Trigger: Passing a leaf/end-entity certificate (e.g. a server or client TLS cert) as the CA override certificate to ValidateAndParseCAOverride.

Common situations: Grabbing the wrong cert from a PEM bundle (leaf instead of CA); using a publicly trusted TLS server cert as an intermediate; generating certificates without the CA basic constraint.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• basic constraints not valid (BasicConstraintsValid=false)
• chain not allowed with an empty certificate
• missing KeyUsage keyCertSign
• NotBefore > NotAfter
• nil certificate override

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/c4c521c07347203e. Report an issue: GitHub.