kubernetes/kops · error

intermediate certificate pool is required

Error message

intermediate certificate pool is required

What it means

Guard in verifySignerCertChain: the intermediate certificate pool argument is nil, so chain building has no intermediates to use. A caller bug — the fetch path must supply at least an empty pool.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:582

	for _, dnsName := range signer.DNSNames {
		if dnsName == azureMetadataDNSName || strings.HasSuffix(dnsName, azureMetadataSubdomainSuffix) {
			return nil
		}
	}

	return fmt.Errorf("signer certificate SAN does not match Azure metadata domains")
}

// verifySignerCertChain verifies that the signer certificate chains to a trusted root CA.
func verifySignerCertChain(signer *x509.Certificate, pkcs7Certs []*x509.Certificate, rootCertPool *x509.CertPool, intermediateCerts *x509.CertPool) error {
	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}
	if rootCertPool == nil {
		return fmt.Errorf("root certificate pool is required")
	}
	if intermediateCerts == nil {
		return fmt.Errorf("intermediate certificate pool is required")
	}

	intermediates := intermediateCerts.Clone()
	for _, cert := range pkcs7Certs {
		intermediates.AddCert(cert)
	}

	_, err := signer.Verify(x509.VerifyOptions{
		Roots:         rootCertPool,
		Intermediates: intermediates,
		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
	})
	return err
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the caller to pass x509.NewCertPool() (or fetched intermediates) instead of nil

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:582 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/300d0571509da031. Report an issue: GitHub.