kubernetes/kops · error

client certificate missing Common Name

Error message

client certificate missing Common Name

What it means

AuthenticateClientToUniverse derives the client's identity from the Common Name (CN) of the leaf certificate in the verified chain. If Subject.CommonName is empty there is no client ID to return, so authentication fails with this error.

Source

Thrown at discovery/pkg/discovery/auth.go:90

	var matchingChain []*x509.Certificate
	for _, verifiedChain := range verifiedChains {
		for _, cert := range verifiedChain {
			hash := sha256.Sum256(cert.RawSubjectPublicKeyInfo)
			calculatedUniverseID := hex.EncodeToString(hash[:])
			if calculatedUniverseID == universeID {
				matchingChain = verifiedChain
				break
			}
		}
	}

	if matchingChain == nil {
		return nil, fmt.Errorf("client certificate chain does not match universe ID")
	}

	clientID := matchingChain[0].Subject.CommonName
	if clientID == "" {
		return nil, fmt.Errorf("client certificate missing Common Name")
	}

	return &UserInfo{
		UniverseID: universeID,
		ClientID:   clientID,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-issue the client certificate ensuring the CSR includes a Subject CommonName.
2. Set CN when generating the key/cert (e.g. openssl req -subj "/CN=my-client" or cert-manager commonName field).
3. Confirm the signing tooling did not strip the Subject during issuance.

Example fix

// before: CSR without CN
openssl req -new -subj "/O=org" -key client.key -out client.csr
// after
openssl req -new -subj "/O=org/CN=my-client" -key client.key -out client.csr

if leaf.Subject.CommonName == "" {
	return errors.New("refusing to use client cert with empty CN; regenerate with a CommonName")
}

func hasCommonName(cert *x509.Certificate) bool {
	return cert != nil && cert.Subject.CommonName != ""
}

When it happens

Trigger: Presenting a client certificate whose leaf has an empty Subject CN, even though the chain verified and matched the universe ID.

Common situations: Certificates generated with CSR templates omitting CN (e.g. only O/OU set, or modern tooling using SANs only); certs issued by CSRs lacking a CommonName field.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• client certificate chain does not match universe ID
• reading %q certificate: %v
• error issuing certificate: %v
• error reading user provided cert %q: %v
• error loading certificate %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6039c8ad470bbbdf. Report an issue: GitHub.