kubernetes/kops · error

error generating certificate serial number: %s

Error message

error generating certificate serial number: %s

What it means

signNewCertificate generates a random 128-bit serial number via crypto/rand when the template has none; this error wraps crypto_rand.Int failure, meaning the system CSPRNG failed (effectively only on catastrophic OS-level entropy errors). Certificate issuance cannot proceed without a serial.

Source

Thrown at pkg/pki/csr.go:69

	if template.PublicKey == nil {
		return nil, fmt.Errorf("PublicKey not set, and cannot be determined from %T", privateKey)
	}

	now := time.Now()
	if template.NotBefore.IsZero() {
		template.NotBefore = now.Add(time.Hour * -48)
	}

	if template.NotAfter.IsZero() {
		template.NotAfter = now.Add(time.Hour * 10 * 365 * 24)
	}

	if template.SerialNumber == nil {
		serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
		serialNumber, err := crypto_rand.Int(crypto_rand.Reader, serialNumberLimit)
		if err != nil {
			return nil, fmt.Errorf("error generating certificate serial number: %s", err)
		}
		template.SerialNumber = serialNumber
	}
	var parent *x509.Certificate
	if signer != nil {
		parent = signer
	} else {
		parent = template
		signerPrivateKey = privateKey
	}

	if template.KeyUsage == 0 {
		template.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment
	}

	if template.ExtKeyUsage == nil && !template.IsCA {
		template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check OS entropy availability (/dev/urandom) and system health
2. Retry certificate issuance; this is typically transient
3. Investigate the underlying crypto/rand error reported in the message

When it happens

Trigger: Thrown at pkg/pki/csr.go:69 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9cd9d2fac47b037c. Report an issue: GitHub.