kubernetes/kops · error

failed to serialize public key to DER format: %v

Error message

failed to serialize public key to DER format: %v

What it means

This error is returned by the OIDCKeys.Open() method in kOps when building the OIDC service-account public keys document (JWKS). For each trusted service-account certificate in the signing keyset, the code serializes the certificate's public key to DER/SPKI format via x509.MarshalPKIXPublicKey; if Go's crypto/x509 package cannot marshal the key, this error is thrown. It means the public key inside the certificate is of a type or state that x509 refuses to serialize.

Source

Thrown at pkg/model/issuerdiscovery.go:199

	}
}

func (o *OIDCKeys) Open() (io.Reader, error) {
	keyset := o.SigningKey.Keyset()
	var keys []jose.JSONWebKey

	for _, item := range keyset.Items {
		if item.DistrustTimestamp != nil {
			continue
		}
		if item.Certificate == nil || item.Certificate.Subject.CommonName != "service-account" {
			continue
		}

		publicKey := item.Certificate.PublicKey
		publicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)
		if err != nil {
			return nil, fmt.Errorf("failed to serialize public key to DER format: %v", err)
		}

		hasher := crypto.SHA256.New()
		hasher.Write(publicKeyDERBytes)
		publicKeyDERHash := hasher.Sum(nil)

		keyID := base64.RawURLEncoding.EncodeToString(publicKeyDERHash)

		keys = append(keys, jose.JSONWebKey{
			Key:       publicKey,
			KeyID:     keyID,
			Algorithm: string(jose.RS256),
			Use:       "sig",
		})
	}
	sort.Slice(keys, func(i, j int) bool {
		return keys[i].KeyID < keys[j].KeyID
	})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the service-account signing keyset in the kOps state store and regenerate it with a standard RSA/ECDSA key (e.g. kops replace secrets or delete the keyset and re-run kops update).
2. Verify the certificate's PublicKey is non-nil and is a supported type (RSA, ECDSA, Ed25519) before it enters the keyset.
3. Recreate the cluster's service-account keypair with standard tooling so the DER/SPKI marshalling succeeds.
4. Upgrade kOps/Go toolchain if the key uses a newer algorithm unsupported by the build's x509 package.

Example fix

// before: trusting arbitrary keyset items
publicKey := item.Certificate.PublicKey
publicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)
if err != nil {
    return nil, fmt.Errorf("failed to serialize public key to DER format: %v", err)
}
// after: pre-validate the key type
publicKey := item.Certificate.PublicKey
switch publicKey.(type) {
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
default:
    continue // skip unsupported service-account keys
}
publicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)
if err != nil {
    return nil, fmt.Errorf("failed to serialize public key to DER format: %v", err)
}

for _, item := range keyset.Items {
    if item.Certificate == nil || item.Certificate.PublicKey == nil {
        continue // skip malformed entries before marshalling
    }
    switch item.Certificate.PublicKey.(type) {
    case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
    default:
        continue // unsupported key type would fail MarshalPKIXPublicKey
    }
}

func isMarshalablePublicKey(k crypto.PublicKey) bool {
    switch k.(type) {
    case *rsa.PublicKey, *ecdsa.PublicKey, *ecdsa.PrivateKey, ed25519.PublicKey:
        return true
    default:
        return false
    }
}

When it happens

Trigger: Calling Open() on the OIDCKeys task when a keyset item's Certificate.PublicKey is nil, unsupported (e.g. an exotic/unregistered curve, generic crypto.Signer implementing type x509 cannot handle), or otherwise fails x509.MarshalPKIXPublicKey.

Common situations: A corrupted or hand-crafted CA keyset in the kOps state store; a certificate produced by an unusual key algorithm (e.g. non-RSA/ECDSA/Ed25519 key type) placed in the service-account signing keyset; state-store data tampering or partial writes from an interrupted update.

Related errors

• error converting public key to x509: %w
• parsing key: %v
• error generating private key: %v
• error issuing certificate: %v
• creating signer for private key %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c155187db1169306. Report an issue: GitHub.