kubernetes/kops · error

loading system certificate pool: %w

Error message

loading system certificate pool: %w

What it means

newAttestationVerifier could not load the OS trust store via x509.SystemCertPool while preparing root CA verification for Azure attestation. Fires on platform issues reading the system certificate bundle.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:108

	rootCertPool *x509.CertPool

	// positiveCache caches successful intermediate fetches. negativeCache caches recent fetch
	// failures for a shorter window, keyed the same way, so attackers cannot amplify fetches via
	// bogus AIA URLs. Stores are read positive-first; transient overlap is harmless.
	positiveCache expirationcache.Store
	negativeCache expirationcache.Store

	// client is reused for intermediate fetches so each lookup does not build a new transport
	// stack. The allowlist lives in URL validation, not in the client.
	client *http.Client
}

// newAttestationVerifier returns an attestationVerifier anchored at the system root certificate
// pool.
func newAttestationVerifier() (*attestationVerifier, error) {
	rootCertPool, err := x509.SystemCertPool()
	if err != nil {
		return nil, fmt.Errorf("loading system certificate pool: %w", err)
	}

	return &attestationVerifier{
		rootCertPool:  rootCertPool,
		positiveCache: expirationcache.NewTTLStore(intermediateCertCacheEntryKeyFunc, intermediateCertRefreshInterval),
		negativeCache: expirationcache.NewTTLStore(intermediateCertCacheEntryKeyFunc, intermediateCertNegativeCacheInterval),
		client:        &http.Client{Timeout: 10 * time.Second},
	}, nil
}

// intermediateCertCacheEntry is the object stored in the TTLStore caches.
type intermediateCertCacheEntry struct {
	key  string
	pool *x509.CertPool
}

// intermediateCertCacheEntryKeyFunc is the TTLStore key function for cache entries.
func intermediateCertCacheEntryKeyFunc(obj any) (string, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the system CA bundle exists and is readable (e.g. /etc/ssl/certs on Linux)
2. Set SSL_CERT_FILE/SSL_CERT_DIR to a valid bundle as a workaround

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:108 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8e09976bb4b95aab. Report an issue: GitHub.