hashicorp/packer · error

request Fulcio certificate: %w

Error message

request Fulcio certificate: %w

What it means

This error wraps a failure from the Fulcio CertificateProvider's GetCertificate call, which exchanges the ambient OIDC ID token for a short-lived signing certificate bound to the ephemeral keypair. The library throws it when the Fulcio CA rejects or cannot process the request — most commonly an expired/invalid/insufficient-audience OIDC token, a network failure, or an unreachable/misconfigured Fulcio URL.

Source

Thrown at internal/attestation/sign_keyless.go:113

	fulcioURL := strings.TrimSpace(cfg.FulcioURL)
	if fulcioURL == "" {
		fulcioURL = defaultFulcioURL
	}

	idToken, err := resolveAmbientIDToken(ctx, cfg.Env)
	if err != nil {
		return nil, err
	}

	keypair, err := newKeylessEphemeralKeypair()
	if err != nil {
		return nil, fmt.Errorf("generate ephemeral keypair: %w", err)
	}

	fulcio := newKeylessFulcio(fulcioURL)
	certDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})
	if err != nil {
		return nil, fmt.Errorf("request Fulcio certificate: %w", err)
	}

	certificate, err := x509.ParseCertificate(certDER)
	if err != nil {
		return nil, fmt.Errorf("parse Fulcio certificate: %w", err)
	}

	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
	verifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)
	if err != nil {
		return nil, fmt.Errorf("create keyless verifier: %w", err)
	}

	return &keylessSigner{
		keypair:  keypair,
		certPEM:  certPEM,
		cert:     certificate,
		verifier: verifier,

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the OIDC token is fresh and its audience matches the Fulcio deployment's expected audience (sigstore for public good); request a new token.
2. Check network reachability of the configured fulcio_url (`curl -I <fulcio_url>`) and fix proxy/egress rules.
3. For GitHub Actions, ensure the workflow sets `permissions: id-token: write`.
4. Confirm fulcio_url in the backend config points to the correct Fulcio instance for the OIDC issuer used.
5. Check system clock skew (NTP) if the token is rejected as invalid.

Example fix

// before (GitHub Actions workflow)
jobs:
  release:
    steps: [...]
// after
jobs:
  release:
    permissions:
      id-token: write
      contents: read
    steps: [...]

// Pre-flight checks before signing:
// 1) an ambient OIDC token is resolvable
// (SIGSTORE_ID_TOKEN / CI_JOB_JWT_V2 / GitHub ACTIONS_ID_TOKEN_REQUEST_URL)
// 2) Fulcio is reachable
resp, err := http.Get(fulcioURL + "/api/v1/rootCert")
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("Fulcio %s unreachable", fulcioURL)
}

signer, err := newKeylessSigner(ctx, cfg)
if err != nil && strings.Contains(err.Error(), "request Fulcio certificate") {
    // refresh the OIDC token and retry with backoff; check network/proxy
}

When it happens

Trigger: newKeylessSigner (internal/attestation/sign_keyless.go:110-114) calls fulcio.GetCertificate(ctx, keypair, options) with the resolved ambient ID token; error occurs on HTTP failure at cfg.FulcioURL (default https://fulcio.sigstore.dev), OIDC token rejection, or request signing failure.

Common situations: SIGSTORE_ID_TOKEN expired or with wrong audience (Fulcio expects sigstore audience); GitHub Actions workflow lacks `permissions: id-token: write` so the token request returns nothing usable; corporate proxy/firewall blocking fulcio.sigstore.dev; custom fulcio_url pointing at a down or wrong-versioned Fulcio instance; clock skew invalidating the token.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• build Sigstore bundle: %w
• signing_mode %q requires an ambient OIDC token; set SIGSTORE
• request GitHub OIDC token: %w
• sign attestation with Sigstore bundle: %w
• error retrieving iteration from HCP Packer registry: %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/8c83589f805c1e1b. Report an issue: GitHub.