kubernetes/kops · error

signer certificate SAN does not match Azure metadata domains

Error message

signer certificate SAN does not match Azure metadata domains

What it means

The signer certificate of the PKCS7 attestation carries no DNS SAN matching metadata.azure.com or *.metadata.azure.com, so it does not identify as the Azure metadata endpoint and the attestation is not trusted.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:570

		Host:   base.Host,
		Path:   candidatePath,
	}).String(), true
}

// Azure guidance requires the metadata signer certificate to identify metadata.azure.com or a
// regional *.metadata.azure.com name in its DNS SANs.
func validateAzureMetadataSignerSAN(signer *x509.Certificate) error {
	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}

	for _, dnsName := range signer.DNSNames {
		if dnsName == azureMetadataDNSName || strings.HasSuffix(dnsName, azureMetadataSubdomainSuffix) {
			return nil
		}
	}

	return fmt.Errorf("signer certificate SAN does not match Azure metadata domains")
}

// verifySignerCertChain verifies that the signer certificate chains to a trusted root CA.
func verifySignerCertChain(signer *x509.Certificate, pkcs7Certs []*x509.Certificate, rootCertPool *x509.CertPool, intermediateCerts *x509.CertPool) error {
	if signer == nil {
		return fmt.Errorf("signer certificate is required")
	}
	if rootCertPool == nil {
		return fmt.Errorf("root certificate pool is required")
	}
	if intermediateCerts == nil {
		return fmt.Errorf("intermediate certificate pool is required")
	}

	intermediates := intermediateCerts.Clone()
	for _, cert := range pkcs7Certs {
		intermediates.AddCert(cert)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation token
2. Update kOps if Azure changed the metadata signing certificate's SANs

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:570 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5bf1ee5878270af3. Report an issue: GitHub.