kubernetes/kops · error
error parsing certificate: %v
Error message
error parsing certificate: %v
What it means
Certificate.UnmarshalJSON accepts JSON strings containing PEM-encoded certificates, decodes base64/PEM blocks, and parses them into an x509 certificate. If all decode attempts fail to yield a parseable certificate, it logs the invalid data and returns "error parsing certificate: %v". A JSON string that decodes but is not a certificate is instead rejected with a separate "unknown format" error.
Source
Thrown at pkg/pki/certificate.go:61
s := ""
if err := json.Unmarshal(b, &s); err == nil {
r, err := ParsePEMCertificate([]byte(s))
if err != nil {
// Alternative form: Check if base64 encoded
// TODO: Do we need this? I think we need this only on nodeup, but maybe we could just not base64-it?
d, err2 := base64.StdEncoding.DecodeString(s)
if err2 == nil {
r2, err2 := ParsePEMCertificate(d)
if err2 == nil {
klog.Warningf("used base64 decode of certificate")
r = r2
err = nil
}
}
if err != nil {
klog.Infof("Invalid certificate data: %q", string(b))
return fmt.Errorf("error parsing certificate: %v", err)
}
}
*c = *r
return nil
}
return fmt.Errorf("unknown format for Certificate: %q", string(b))
}
func (c *Certificate) MarshalJSON() ([]byte, error) {
var data bytes.Buffer
_, err := c.WriteTo(&data)
if err != nil {
return nil, fmt.Errorf("error writing SSL certificate: %v", err)
}
return json.Marshal(data.String())
}
func ParsePEMCertificate(pemData []byte) (*Certificate, error) {View on GitHub (pinned to 4c8573c808)
Solutions
- Verify the field contains a full PEM certificate including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
- Check the cert decodes: openssl x509 -in cert.pem -text -noout; re-export from the source.
- Ensure you did not paste the private key or CSR instead of the certificate.
- Check for YAML indentation/line-folding damage that stripped newlines, and re-run kops.
Example fix
// before (YAML) certificate: LS0tLS1CRUdJTiBD...TRUNCATED // after certificate: | -----BEGIN CERTIFICATE----- MIID...full base64... -----END CERTIFICATE-----
Defensive patterns
Strategy: validation
Validate before calling
func validPEMCert(s string) bool {
block, _ := pem.Decode([]byte(s))
if block == nil || block.Type != "CERTIFICATE" { return false }
_, err := x509.ParseCertificate(block.Bytes)
return err == nil
}
if !validPEMCert(certString) { return errors.New("invalid certificate before unmarshal") } Try / catch
if err := json.Unmarshal(data, &cert); err != nil {
if strings.Contains(err.Error(), "error parsing certificate") {
// re-fetch/repair the PEM blob before retrying
}
return err
} Prevention
- Store certificates with full BEGIN/END lines and intact newlines (YAML block scalar '|')
- Validate with openssl x509 before committing to config
- Never paste private keys or CSRs into certificate fields
- Use kops create secret instead of hand-editing manifests
When it happens
Trigger: Unmarshaling a Certificate from JSON whose string is not valid PEM/base64 x509 data; parsing a kops cluster/instance group YAML with a hand-edited or corrupted certificate field.
Common situations: Copy-pasting a certificate that lost its BEGIN/END lines or newlines during YAML editing; using a private key where a certificate is expected; expired/truncated cert blobs from a secrets manager export.
Understand the failure class
- SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
Related errors
- reading %q certificate: %v
- error issuing certificate: %v
- unable to issue certificate: %v
- unrecognized certificate option: %v
- unrecognized certificate option: %q
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/0db642d475a6c9d1.
Report an issue: GitHub.