kubernetes/kops · error

error creating certificate: %v

Error message

error creating certificate: %v

What it means

Render creates the new keypair by calling CreateKeyset, which looks up any existing keyset, issues a certificate via pki.IssueCert (signed by the CA identified by the signer keypair name), and stores the result via keystore.StoreKeyset. Any failure inside this pipeline — signing errors, CA keypair not found, keystore write failures — is wrapped as 'error creating certificate'.

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:224

		if len(subjectPkix.ToRDNSequence()) == 0 {
			return fmt.Errorf("subject name was empty for SSL keypair %q", *e.Name)
		}

		signer := fi.CertificateIDCA
		if e.Signer != nil {
			signer = fi.ValueOf(e.Signer.Name)
		}

		req := pki.IssueCertRequest{
			Signer:         signer,
			Type:           e.Type,
			Subject:        *subjectPkix,
			AlternateNames: e.AlternateNames,
		}

		keyset, err := CreateKeyset(ctx, c.T.Keystore, name, req)
		if err != nil {
			return fmt.Errorf("error creating certificate: %v", err)
		}

		if err := e.setResources(keyset); err != nil {
			return fmt.Errorf("error setting resources: %v", err)
		}

		// Make double-sure it round-trips
		if roundtrip, err := c.T.Keystore.FindKeyset(ctx, name); err != nil {
			return err
		} else if roundtrip == nil {
			return fmt.Errorf("unable to find created certificate %q: %w", name, err)
		}

		klog.V(8).Infof("created certificate with subject %v", subjectPkix)
	}

	// TODO: Check correct subject / flags

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the signer CA keypair exists: `kops get secrets keypair kubernetes-ca` (recreate/rotate the CA if missing)
2. Verify state store connectivity and credentials (try `kops get cluster` against the same store)
3. Fix keystore write permissions / retry if a transient backend error occurred
4. Run `kops update cluster` again after fixing; if a partial keyset was written, delete and regenerate it

Example fix

// before: 'kubernetes-ca' missing in state store
// after
kops toolbox pki ... # or restore CA keyset, then
kops update cluster --yes

if _, err := keystore.FindKeyset(ctx, signerName); err != nil || keystore == nil { return fmt.Errorf("signer keyset %q must exist before issuing", signerName) }

if err != nil { if strings.Contains(err.Error(), "error creating certificate") && isTransient(err) { time.Sleep(backoff); return retry() } return err }

When it happens

Trigger: Render with createCertificate=true where CreateKeyset fails: the signer keyset (usually 'kubernetes-ca' or the referenced e.Signer name) is missing, pki.IssueCert fails (unsupported key type, bad request), or keystore.StoreKeyset cannot persist (state-store backend error, permissions, network).

Common situations: CA keypair deleted from the state store so there is nothing to sign with; S3/GCS state store unreachable or credentials expired; concurrent updates corrupting the keystore; rotating a CA without regenerating dependent keypairs.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• unknown CA %q
• unable to issue certificate: %v
• ca key for %q was not found; cannot issue certificates
• ca certificate for %q was not found; cannot issue certificat
• error finding discovery CA: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ae0e235bf210bd4e. Report an issue: GitHub.