kubernetes/kops · error

subject name was empty for SSL keypair %q

Error message

subject name was empty for SSL keypair %q

What it means

parsePkixName can return an empty pkix.Name without error (e.g. if the subject produces no RDNs, or only whitespace tokens). Since a certificate with an empty subject is invalid, Render explicitly rejects it with 'subject name was empty for SSL keypair <name>'. This is a sanity check immediately after parsing succeeds.

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:207

			createCertificate = true
			klog.Infof("creating certificate %q as Type has changed (actual=%v, expected=%v)", name, a.Type, e.Type)
		} else if a.LegacyFormat {
			changeStoredFormat = true
		} else {
			klog.Warningf("Ignoring changes in key: %v", fi.DebugAsJsonString(changes))
		}
	}

	if createCertificate {
		klog.V(2).Infof("Creating PKI keypair %q", name)

		subjectPkix, err := parsePkixName(e.Subject)
		if err != nil {
			return fmt.Errorf("error parsing Subject: %v", err)
		}

		if len(subjectPkix.ToRDNSequence()) == 0 {
			return fmt.Errorf("subject name was empty for SSL keypair %q", *e.Name)
		}

		signer := fi.CertificateIDCA
		if e.Signer != nil {
			signer = fi.ValueOf(e.Signer.Name)
		}

		req := pki.IssueCertRequest{
			Signer:         signer,
			Type:           e.Type,
			Subject:        *subjectPkix,
			AlternateNames: e.AlternateNames,
		}

		keyset, err := CreateKeyset(ctx, c.T.Keystore, name, req)
		if err != nil {
			return fmt.Errorf("error creating certificate: %v", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set a valid Subject containing at least a CN, e.g. 'CN=<name>,O=kops'
2. Find why the spec value is empty (missing config field, unset variable) and populate it
3. Validate the subject string non-empty before running kops update

Example fix

// before
keypair.Subject = cfg.TLSSubject // ""
// after
keypair.Subject = "CN=apiserver-api,O=kops"

if strings.TrimSpace(subject) == "" { return errors.New("keypair subject must be non-empty, e.g. CN=apiserver,O=kops") }

When it happens

Trigger: Render with createCertificate=true where parsePkixName(e.Subject) succeeds but subjectPkix.ToRDNSequence() is empty — e.g. an empty Subject string or a subject that yields no CN/O values.

Common situations: Cluster spec field for a keypair subject left blank; subject built programmatically from an empty/missing config value; edge cases where the subject string parses but maps to no recognized RDN.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• error parsing Subject: %v
• error issuing certificate: %v
• error converting public key to x509: %w
• error parsing certificate: %v
• error encoding ECDSA private key: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9b42ca4b6791fb59. Report an issue: GitHub.