kubernetes/kops · error

fetched certificate subject key identifier does not match si

Error message

fetched certificate subject key identifier does not match signer authority key identifier

What it means

Structural check in validateFetchedIntermediateForSigner: the fetched certificate's SubjectKeyId does not equal the signer's AuthorityKeyId, so the key identity does not match the referenced issuer.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:479

	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}
	if cert == nil {
		return fmt.Errorf("fetched certificate is required")
	}
	if !cert.IsCA {
		return fmt.Errorf("fetched certificate is not a CA certificate")
	}
	// Require at least one issuer identifier so the per-field length guards below cannot silently
	// degrade to "no identity check" if both fields happen to be empty.
	if len(signer.RawIssuer) == 0 && len(signer.AuthorityKeyId) == 0 {
		return fmt.Errorf("signer certificate has neither RawIssuer nor AuthorityKeyId set")
	}
	if len(signer.RawIssuer) > 0 && !bytes.Equal(cert.RawSubject, signer.RawIssuer) {
		return fmt.Errorf("fetched certificate subject does not match signer issuer")
	}
	if len(signer.AuthorityKeyId) > 0 && !bytes.Equal(cert.SubjectKeyId, signer.AuthorityKeyId) {
		return fmt.Errorf("fetched certificate subject key identifier does not match signer authority key identifier")
	}

	return nil
}

// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only
// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them
// onto the configured scheme and host.
func microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {
	if signer == nil {
		return nil, fmt.Errorf("signer certificate is required")
	}

	base, err := url.Parse(baseURL)
	if err != nil {
		return nil, fmt.Errorf("parsing base URL: %w", err)
	}
	if !base.IsAbs() || base.Host == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Discard this intermediate and try the next candidate AIA URL
2. Reject the attestation if no matching intermediate is found

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:479 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/00ded1ea743414dc. Report an issue: GitHub.