kubernetes/kops · error

fetched certificate subject does not match signer issuer

Error message

fetched certificate subject does not match signer issuer

What it means

Structural check in validateFetchedIntermediateForSigner: the fetched certificate's RawSubject does not equal the signer's RawIssuer, so it is not the issuer the signer references.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:476

// referenced by the signer certificate before it is used or cached. This is a structural check
// only; the cryptographic signature is verified later by verifySignerCertChain.
func validateFetchedIntermediateForSigner(signer *x509.Certificate, cert *x509.Certificate) error {
	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}
	if cert == nil {
		return fmt.Errorf("fetched certificate is required")
	}
	if !cert.IsCA {
		return fmt.Errorf("fetched certificate is not a CA certificate")
	}
	// Require at least one issuer identifier so the per-field length guards below cannot silently
	// degrade to "no identity check" if both fields happen to be empty.
	if len(signer.RawIssuer) == 0 && len(signer.AuthorityKeyId) == 0 {
		return fmt.Errorf("signer certificate has neither RawIssuer nor AuthorityKeyId set")
	}
	if len(signer.RawIssuer) > 0 && !bytes.Equal(cert.RawSubject, signer.RawIssuer) {
		return fmt.Errorf("fetched certificate subject does not match signer issuer")
	}
	if len(signer.AuthorityKeyId) > 0 && !bytes.Equal(cert.SubjectKeyId, signer.AuthorityKeyId) {
		return fmt.Errorf("fetched certificate subject key identifier does not match signer authority key identifier")
	}

	return nil
}

// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only
// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them
// onto the configured scheme and host.
func microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {
	if signer == nil {
		return nil, fmt.Errorf("signer certificate is required")
	}

	base, err := url.Parse(baseURL)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Discard this intermediate and try the next candidate AIA URL
2. Reject the attestation if no matching intermediate is found

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:476 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ba314b4ed4b66086. Report an issue: GitHub.