kubernetes/kops · error

error parsing certificate: %v

Error message

error parsing certificate: %v

What it means

signNewCertificate successfully created a self-signed or CA-signed certificate via the signer, but x509.ParseCertificate failed on the DER bytes returned. This means the signer/backend produced bytes that are not a valid DER-encoded X.509 certificate, which should never happen with Go's crypto/x509 CreateCertificate.

Source

Thrown at pkg/pki/csr.go:97

	}

	if template.KeyUsage == 0 {
		template.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment
	}

	if template.ExtKeyUsage == nil && !template.IsCA {
		template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}
	}
	// c.SignatureAlgorithm  = do we want to override?

	certificateData, err := x509.CreateCertificate(crypto_rand.Reader, template, parent, template.PublicKey, signerPrivateKey.Key)
	if err != nil {
		return nil, fmt.Errorf("error creating certificate: %v", err)
	}

	cert, err := x509.ParseCertificate(certificateData)
	if err != nil {
		return nil, fmt.Errorf("error parsing certificate: %v", err)
	}

	c := &Certificate{
		Subject:     cert.Subject,
		IsCA:        cert.IsCA,
		Certificate: cert,
		PublicKey:   cert.PublicKey,
	}

	return c, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the CA certificate stored in the keystore is valid PEM/DER and re-create the CA (kops replace / delete and re-export the keypair).
2. Inspect the keypair files under the keyset for truncation or wrong encoding (PEM vs DER) and fix the keystore contents.
3. If using a custom keystore implementation, ensure FindPrimaryKeypair returns raw DER certificate bytes.
4. Upgrade kOps in case of a keystore serialization bug in your version.

// verify CA cert parses before issuing
if caCert != nil && caCert.Certificate == nil {
    return fmt.Errorf("CA certificate bytes missing")
}
if _, err := x509.ParseCertificate(caCert.Certificate); err != nil {
    return fmt.Errorf("CA certificate corrupt: %w", err)
}

func hasValidCert(kp *pki.Keypair) bool {
    return kp != nil && kp.Certificate != nil
}

cert, err := issueCert(...)
if err != nil {
    if strings.Contains(err.Error(), "error parsing certificate") {
        // recreate CA keypair before retrying
    }
    return err
}

When it happens

Trigger: Calling IssueCert/signNewCertificate when the underlying keypair store returns corrupt or non-DER certificateData bytes to parse.

Common situations: Corrupted CA certificate in a file-based or FS keystores (truncated file, wrong encoding such as PEM bytes passed instead of DER), or a custom keystore implementation returning malformed certificate bytes.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• error issuing certificate: %v
• failed to parse certificate: %w
• error converting public key to x509: %w
• error encoding ECDSA private key: %w
• marshalling public key %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d01a0854e081e977. Report an issue: GitHub.