signer certificate has neither RawIssuer nor AuthorityKeyId

Error message

signer certificate has neither RawIssuer nor AuthorityKeyId set

What it means

Guard in validateFetchedIntermediateForSigner: the signer certificate exposes neither a RawIssuer nor an AuthorityKeyId, so there is no identifier to match a fetched intermediate against — the issuer-identity check would silently degrade to a no-op.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:473

}

// validateFetchedIntermediateForSigner checks that a fetched intermediate is actually the issuer
// referenced by the signer certificate before it is used or cached. This is a structural check
// only; the cryptographic signature is verified later by verifySignerCertChain.
func validateFetchedIntermediateForSigner(signer *x509.Certificate, cert *x509.Certificate) error {
	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}
	if cert == nil {
		return fmt.Errorf("fetched certificate is required")
	}
	if !cert.IsCA {
		return fmt.Errorf("fetched certificate is not a CA certificate")
	}
	// Require at least one issuer identifier so the per-field length guards below cannot silently
	// degrade to "no identity check" if both fields happen to be empty.
	if len(signer.RawIssuer) == 0 && len(signer.AuthorityKeyId) == 0 {
		return fmt.Errorf("signer certificate has neither RawIssuer nor AuthorityKeyId set")
	}
	if len(signer.RawIssuer) > 0 && !bytes.Equal(cert.RawSubject, signer.RawIssuer) {
		return fmt.Errorf("fetched certificate subject does not match signer issuer")
	}
	if len(signer.AuthorityKeyId) > 0 && !bytes.Equal(cert.SubjectKeyId, signer.AuthorityKeyId) {
		return fmt.Errorf("fetched certificate subject key identifier does not match signer authority key identifier")
	}

	return nil
}

// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only
// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them
// onto the configured scheme and host.
func microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {
	if signer == nil {
		return nil, fmt.Errorf("signer certificate is required")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Reject the attestation; the signer certificate is malformed for chain building
Update kOps if Microsoft issues signer certs without issuer identifiers

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:473 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/492ffc8f16d85c54. Report an issue: GitHub.