kubernetes/kops · error

parsing %q certificate: %v

Error message

parsing %q certificate: %v

What it means

newKeystore loads each CA's <name>.crt from the CA base path and parses it as a PEM certificate; this error wraps pki.ParsePEMCertificate failing, meaning the file was read but its contents are not a valid PEM certificate.

Source

Thrown at cmd/kops-controller/pkg/server/keystore.go:91

// ListKeysets will return all the KeySets.
func (k *keystore) ListKeysets() (map[string]*fi.Keyset, error) {
	return nil, fmt.Errorf("server-side client does not support ListKeysets")
}

func newKeystore(basePath string, cas []string) (*keystore, map[string]string, error) {
	keystore := &keystore{
		keys:    map[string]keystoreEntry{},
		keySets: map[string]*fi.Keyset{},
	}
	for _, name := range cas {
		certBytes, err := os.ReadFile(path.Join(basePath, name+".crt"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q certificate: %v", name, err)
		}
		// TODO: Support multiple certificates?
		certificate, err := pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q certificate: %v", name, err)
		}

		keyBytes, err := os.ReadFile(path.Join(basePath, name+".key"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q key: %v", name, err)
		}
		key, err := pki.ParsePEMPrivateKey(keyBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q key: %v", name, err)
		}

		keystore.keys[name] = keystoreEntry{
			certificate: certificate,
			key:         key,
		}
	}

	var keypairIDs map[string]string

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the certificate file content at the CABasePath for PEM formatting corruption
2. Regenerate the CA certificate and key pair
3. Ensure the correct file was placed as <name>.crt

When it happens

Trigger: Thrown at cmd/kops-controller/pkg/server/keystore.go:91 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f0c2399cd0e3c54d. Report an issue: GitHub.