kubernetes/kops · error

fetched certificate is not a CA certificate

Error message

fetched certificate is not a CA certificate

What it means

Structural check in validateFetchedIntermediateForSigner: the fetched certificate does not assert the CA basic-constraint, so it cannot validly act as the signer's intermediate issuer.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:468

	cert, err := x509.ParseCertificate(body)
	if err != nil {
		return nil, fmt.Errorf("parsing intermediate certificate from %s: %w", url, err)
	}
	return cert, nil
}

// validateFetchedIntermediateForSigner checks that a fetched intermediate is actually the issuer
// referenced by the signer certificate before it is used or cached. This is a structural check
// only; the cryptographic signature is verified later by verifySignerCertChain.
func validateFetchedIntermediateForSigner(signer *x509.Certificate, cert *x509.Certificate) error {
	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}
	if cert == nil {
		return fmt.Errorf("fetched certificate is required")
	}
	if !cert.IsCA {
		return fmt.Errorf("fetched certificate is not a CA certificate")
	}
	// Require at least one issuer identifier so the per-field length guards below cannot silently
	// degrade to "no identity check" if both fields happen to be empty.
	if len(signer.RawIssuer) == 0 && len(signer.AuthorityKeyId) == 0 {
		return fmt.Errorf("signer certificate has neither RawIssuer nor AuthorityKeyId set")
	}
	if len(signer.RawIssuer) > 0 && !bytes.Equal(cert.RawSubject, signer.RawIssuer) {
		return fmt.Errorf("fetched certificate subject does not match signer issuer")
	}
	if len(signer.AuthorityKeyId) > 0 && !bytes.Equal(cert.SubjectKeyId, signer.AuthorityKeyId) {
		return fmt.Errorf("fetched certificate subject key identifier does not match signer authority key identifier")
	}

	return nil
}

// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only
// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them

View on GitHub (pinned to 4c8573c808)

Solutions

1. Treat the fetch as failed and try the next candidate AIA URL
2. Reject the attestation if no CA intermediate can be found

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:468 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/97589ffede03a162. Report an issue: GitHub.