kubernetes/kops · error

no valid Microsoft PKI AIA URLs found

Error message

no valid Microsoft PKI AIA URLs found

What it means

None of the signer certificate's AIA (IssuingCertificateURL) entries survived normalization onto the Microsoft PKI allowlist, so there is no permitted URL from which to fetch intermediates. Either the signer has no AIA entries or all point outside the allowed host/path.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:521

		return nil, fmt.Errorf("base URL path is too broad")
	}

	var urls []string
	seen := make(map[string]struct{})
	for _, rawURL := range signer.IssuingCertificateURL {
		normalized, ok := normalizeMicrosoftIntermediateURL(base, basePath, rawURL)
		if !ok {
			continue
		}
		if _, found := seen[normalized]; found {
			continue
		}
		seen[normalized] = struct{}{}
		urls = append(urls, normalized)
	}

	if len(urls) == 0 {
		return nil, fmt.Errorf("no valid Microsoft PKI AIA URLs found")
	}

	return urls, nil
}

// normalizeMicrosoftIntermediateURL copies only the allowed parts of a signer AIA URL onto the
// configured Microsoft PKI base URL. This keeps the path we need while ignoring attacker-controlled
// scheme, query, fragment, and userinfo.
func normalizeMicrosoftIntermediateURL(base *url.URL, basePath string, rawURL string) (string, bool) {
	candidate, err := url.Parse(rawURL)
	if err != nil {
		return "", false
	}
	if candidate.User != nil || candidate.RawQuery != "" || candidate.Fragment != "" {
		return "", false
	}
	if candidate.Scheme != "http" && candidate.Scheme != "https" {
		return "", false

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation; the signer is not chainable within the Microsoft PKI allowlist
2. Update kOps if Microsoft moved its intermediate hosting to a new allowlisted location

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:521 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6b6d9f8d28f9f9fd. Report an issue: GitHub.