kubernetes/kops · error

no fetched intermediate certificates matched signer issuer %

Error message

no fetched intermediate certificates matched signer issuer %q

What it means

On the first hop of the AIA chain walk, fetchIntermediateCertsFromBaseURL expects at least one fetched certificate whose subject matches the signer's issuer. If none of the certificates retrieved from the signer's AIA URL match, the walk cannot make progress and this error is thrown — the fetched material would not form a valid chain and must not be used or cached.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:417

		for _, url := range urls {
			klog.V(2).Infof("Fetching intermediate certificate from %s", url)
			cert, err := fetchCertificate(client, url)
			if err != nil {
				return nil, err
			}
			if err := validateFetchedIntermediateForSigner(current, cert); err != nil {
				klog.V(2).Infof("Fetched intermediate certificate from %s did not match issuer: %v", url, err)
				continue
			}
			klog.V(2).Infof("Fetched intermediate certificate from %s matched issuer", url)
			pool.AddCert(cert)
			if issuer == nil {
				issuer = cert
			}
		}
		if issuer == nil {
			if hop == 0 {
				return nil, fmt.Errorf("no fetched intermediate certificates matched signer issuer %q", signer.Issuer)
			}
			// Fetched, but nothing matched current's issuer; stop with what we have.
			break
		}
		current = issuer
	}

	return pool, nil
}

// fetchCertificate fetches and parses a DER-encoded certificate from the given URL.
func fetchCertificate(client *http.Client, url string) (*x509.Certificate, error) {
	resp, err := client.Get(url)
	if err != nil {
		return nil, fmt.Errorf("fetching intermediate certificate from %s: %w", url, err)
	}
	defer resp.Body.Close()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the signer's AIA URL is the correct, current CA issuance endpoint
2. Re-fetch the leaf/signer certificate so its AIA points to the current issuing CA
3. Check that no proxy or custom baseURL is intercepting and altering the fetched certificates
4. Update the base URL / allowlist if the CA vendor changed its intermediate hierarchy

Example fix

// before
baseURL := "https://old-aia.example.com/" // stale CA endpoint
pool, err := fetchIntermediateCerts(clientWithBaseURL(baseURL), signer)
// after
baseURL := signer.AIAEndpoint() // use the AIA URL embedded in the current signer
pool, err := fetchIntermediateCerts(clientWithBaseURL(baseURL), signer)

// Sanity-check that the signer has an issuer name and an AIA URL before the walk
if signer == nil || signer.Issuer == nil || len(signer.OCSPServer) == 0 && len(signer.IssuingCertificateURL) == 0 {
    return nil, fmt.Errorf("signer %v lacks usable issuer/AIA info", signer)
}

func signerHasAIA(c *x509.Certificate) bool {
    return c != nil && len(c.IssuingCertificateURL) > 0
}

pool, err := fetchIntermediateCerts(client, signer)
if err != nil && strings.Contains(err.Error(), "no fetched intermediate certificates matched") {
    // fall back to system intermediate pool or re-fetch a current signer certificate
    return verifyWithSystemIntermediates(signer)
}

When it happens

Trigger: The signer's AIA URL returns certificates that do not match signer.Issuer (wrong CA endpoint, re-issued signer with a new issuer, or an endpoint serving unrelated certificates) and hop == 0.

Common situations: CA migrated to a new intermediate and cached/old signer certificates still reference the previous issuer; misconfigured or mocked AIA endpoints in tests; man-in-the-middle or proxy serving wrong content; Microsoft rotating intermediates.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• signer certificate is required
• intermediate certificate from %s exceeds %d bytes
• parsing intermediate certificate from %s: %w
• decoding pem public key
• parsing key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/76d2987cb2474d09. Report an issue: GitHub.