kubernetes/kops · error

error issuing certificate: %v

Error message

error issuing certificate: %v

What it means

This error wraps a failure from pki.IssueCert() when `kops create keypair` self-signs a new CA certificate for the keyset. The IssueCert request (type "ca", subject = keyset name, the generated private key) could not be processed into a certificate. The wrapped %v holds the underlying crypto/x509 cause.

Source

Thrown at cmd/kops/create_keypair.go:220

	var cert *pki.Certificate
	if options.CertPath == "" {
		if privateKey == nil {
			privateKey, err = pki.GeneratePrivateKey()
			if err != nil {
				return fmt.Errorf("error generating private key: %v", err)
			}
		}

		serial := pki.BuildPKISerial(time.Now().UnixNano())
		req := pki.IssueCertRequest{
			Type:       "ca",
			Subject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},
			Serial:     serial,
			PrivateKey: privateKey,
		}
		cert, _, _, err = pki.IssueCert(ctx, &req, nil)
		if err != nil {
			return fmt.Errorf("error issuing certificate: %v", err)
		}
	} else {
		options.CertPath = utils.ExpandPath(options.CertPath)
		certBytes, err := os.ReadFile(options.CertPath)
		if err != nil {
			return fmt.Errorf("error reading user provided cert %q: %v", options.CertPath, err)
		}

		cert, err = pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return fmt.Errorf("error loading certificate %q: %v", options.CertPath, err)
		}
	}

	keyset, err := keyStore.FindKeyset(ctx, name)
	var item *fi.KeysetItem
	if os.IsNotExist(err) || (err == nil && keyset == nil) {
		if options.Primary {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error (%v) for the precise x509/crypto cause.
2. Retry the command; issuance failures here are rarely user-caused.
3. Verify the private key generated/parsed earlier is valid.
4. Upgrade kOps to the latest patch release and retry.

if err != nil && strings.Contains(err.Error(), "error issuing certificate") {
    // inspect wrapped cause, regenerate the private key, retry once
}

When it happens

Trigger: Calling `kops create keypair` without --cert so a new CA cert is issued via pki.IssueCert(ctx, &req, nil), and the signing/issuance step returns an error.

Common situations: Keypair creation for a cluster CA on a broken or mismatched kOps build; unexpected pki library failure while signing the just-generated key.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• reading %q certificate: %v
• failed to create certificate: %w
• error converting public key to x509: %w
• unable to issue certificate: %v
• error parsing certificate: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d8a2d560af507e05. Report an issue: GitHub.