kubernetes/kops · error

error loading certificate %q: %v

Error message

error loading certificate %q: %v

What it means

This error occurs when the file passed via --cert to `kops create keypair` was read successfully but is not a parseable PEM certificate. pki.ParsePEMCertificate rejects the bytes, so the supplied certificate cannot be used for the keyset.

Source

Thrown at cmd/kops/create_keypair.go:231

			Type:       "ca",
			Subject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},
			Serial:     serial,
			PrivateKey: privateKey,
		}
		cert, _, _, err = pki.IssueCert(ctx, &req, nil)
		if err != nil {
			return fmt.Errorf("error issuing certificate: %v", err)
		}
	} else {
		options.CertPath = utils.ExpandPath(options.CertPath)
		certBytes, err := os.ReadFile(options.CertPath)
		if err != nil {
			return fmt.Errorf("error reading user provided cert %q: %v", options.CertPath, err)
		}

		cert, err = pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return fmt.Errorf("error loading certificate %q: %v", options.CertPath, err)
		}
	}

	keyset, err := keyStore.FindKeyset(ctx, name)
	var item *fi.KeysetItem
	if os.IsNotExist(err) || (err == nil && keyset == nil) {
		if options.Primary {
			if keyset, err = fi.NewKeyset(cert, privateKey); err != nil {
				return err
			}
		} else {
			return fmt.Errorf("the first keypair added to a keyset must be primary")
		}
		item = keyset.Primary
	} else if err != nil {
		return fmt.Errorf("reading existing keyset: %v", err)
	} else {
		item, err = keyset.AddItem(cert, privateKey, options.Primary)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the file starts with '-----BEGIN CERTIFICATE-----'.
2. Convert DER to PEM: openssl x509 -inform der -in cert.cer -out cert.pem.
3. Confirm it is a certificate, not a key or CSR: openssl x509 -in cert.pem -noout -text.
4. Re-export the certificate to rule out truncation/corruption.

Example fix

// before
kops create keypair cluster.name kubernetes-ca --cert ca.der
// error loading certificate: no PEM block found
// after
openssl x509 -inform der -in ca.der -out ca.pem
kops create keypair cluster.name kubernetes-ca --cert ca.pem

pemBytes, _ := os.ReadFile(certPath)
block, _ := pem.Decode(pemBytes)
if block == nil || block.Type != "CERTIFICATE" {
    return errors.New("file is not a PEM certificate")
}
if _, err := x509.ParseCertificate(block.Bytes); err != nil {
    return fmt.Errorf("not a valid x509 cert: %w", err)
}

func isPEMCertificate(b []byte) bool {
    block, _ := pem.Decode(b)
    return block != nil && block.Type == "CERTIFICATE"
}

if err != nil && strings.Contains(err.Error(), "error loading certificate") {
    // verify PEM encoding with openssl and re-export the cert
}

When it happens

Trigger: Running `kops create keypair --cert <path>` where the file is not PEM-encoded, is truncated, is a private key or CSR instead of a certificate, or is an empty/garbage file.

Common situations: Passing a DER (.cer/.der) binary cert instead of PEM; passing the private key file by mistake; transfers that mangled PEM headers/whitespace; empty file.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• error loading private key %q: %v
• error loading certificate %s/%s: %v
• error parsing addons or manifest: %v
• error parsing addons: %v
• failed to parse objects: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/200ea58d9d36aae8. Report an issue: GitHub.