ca certificate for %q was not found; cannot issue certificat

Error message

ca certificate for %q was not found; cannot issue certificates

What it means

Companion to error 1564: FindPrimaryKeypair returned a CA keypair whose certificate is nil. Without the CA certificate, issued certificates would lack a proper issuer, so IssueCert rejects the request.

Source

Thrown at pkg/pki/issue.go:129

			template.IPAddresses = append(template.IPAddresses, ip)
		} else {
			template.DNSNames = append(template.DNSNames, san)
		}
	}

	var caPrivateKey *PrivateKey
	var signer *x509.Certificate
	if !template.IsCA {
		var err error
		caCertificate, caPrivateKey, err = keystore.FindPrimaryKeypair(ctx, request.Signer)
		if err != nil {
			return nil, nil, nil, err
		}
		if caPrivateKey == nil {
			return nil, nil, nil, fmt.Errorf("ca key for %q was not found; cannot issue certificates", request.Signer)
		}
		if caCertificate == nil {
			return nil, nil, nil, fmt.Errorf("ca certificate for %q was not found; cannot issue certificates", request.Signer)
		}
		signer = caCertificate.Certificate
	}

	privateKey := request.PrivateKey
	if request.PublicKey != nil {
		template.PublicKey = request.PublicKey
	} else if privateKey == nil {
		var err error
		privateKey, err = GeneratePrivateKey()
		if err != nil {
			return nil, nil, nil, err
		}
	}

	if request.Validity != 0 {
		template.NotAfter = time.Now().Add(request.Validity).UTC()
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Re-import or restore the CA certificate into the keyset for the named signer.
Recreate the CA keypair entirely and re-run installPKI if the certificate is unrecoverable.
Verify the keyset contents with kops toolbox before issuing certificates.

Defensive patterns

Strategy: validation

Validate before calling

cert, key, err := keystore.FindPrimaryKeypair(ctx, signer)
if err != nil { return err }
if cert == nil {
    return fmt.Errorf("CA %s certificate missing; restore keyset first", signer)
}

Type guard

func caReady(kp *pki.Keypair) bool {
    return kp != nil && kp.Certificate != nil && kp.PrivateKey != nil
}

Try / catch

if err := issueCert(...); err != nil {
    if strings.Contains(err.Error(), "ca certificate for") {
        // re-import CA cert or recreate CA, then retry
    }
    return err
}

Prevention

Verify both halves of the CA keypair exist before issuance
Use atomic keyset writes during CA rotation
Audit the state-store pki directory after migrations

When it happens

Trigger: Issuing with request.Signer pointing to a CA keyset that holds the private key but no certificate — e.g. partial import where only the key was written, or the cert entry was deleted/corrupted.

Common situations: Manual editing of the state-store keyset, failed CA rotation leaving a half-written keypair, or keystore migration losing the certificate half.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/94e14a8557f2ed7e. Report an issue: GitHub.