kubernetes/kops · error

fetching intermediate certificates: %w

Error message

fetching intermediate certificates: %w

What it means

Fetching the intermediate certificates (from the Microsoft PKI AIA URLs, subject to allowlist and caching) failed while trying to complete the signer's chain after embedded certificates were insufficient. A network or upstream PKI endpoint failure.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:219

	// Verify using only the certificates embedded in the PKCS7 structure; if that succeeds, the signer
	// is trusted. If it fails but the PKCS7 already embeds a cert matching the signer's issuer, the
	// chain is genuinely broken (not just missing an intermediate), so fail fast instead of fetching.
	chainErr := verifySignerCertChain(signer, p7.Certificates, rootCertPool, x509.NewCertPool())
	if chainErr == nil {
		klog.V(2).Infof("PKCS7 certificate chain verified with embedded certificates for signer issuer %q", signer.Issuer)
		return data, nil
	}
	for _, cert := range p7.Certificates {
		if validateFetchedIntermediateForSigner(signer, cert) == nil {
			return nil, fmt.Errorf("verifying PKCS7 certificate chain with embedded intermediates: %w", chainErr)
		}
	}

	klog.V(4).Infof("Resolving intermediate certificates for signer issuer %q", signer.Issuer)
	intermediateCerts, err := fetchIntermediates(signer)
	if err != nil {
		return nil, fmt.Errorf("fetching intermediate certificates: %w", err)
	}
	if err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {
		return nil, fmt.Errorf("verifying PKCS7 certificate chain: %w", err)
	}
	klog.V(4).Infof("PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q", signer.Issuer)

	return data, nil
}

// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its
// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata
// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call
// before triggering intermediate certificate fetches.
func parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {
	if signature == "" {
		return nil, nil, fmt.Errorf("empty PKCS7 signature")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check outbound network access to the Microsoft PKI hosts from the control plane
2. Retry; AIA fetches are cached and transient failures clear on the next attempt
3. Confirm the allowlisted Microsoft intermediate cert base URL is still valid (PKI endpoints occasionally move)

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:219 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c80ffdffe9134bde. Report an issue: GitHub.