kubernetes/kops · error

unknown format for Certificate: %q

Error message

unknown format for Certificate: %q

What it means

Fires in Certificate.UnmarshalJSON when the JSON value is neither a PEM string nor base64-encoded PEM data — the unmarshal helper falls through its decode attempts and rejects the raw bytes as an unrecognized certificate encoding.

Source

Thrown at pkg/pki/certificate.go:67

			d, err2 := base64.StdEncoding.DecodeString(s)
			if err2 == nil {
				r2, err2 := ParsePEMCertificate(d)
				if err2 == nil {
					klog.Warningf("used base64 decode of certificate")
					r = r2
					err = nil
				}
			}

			if err != nil {
				klog.Infof("Invalid certificate data: %q", string(b))
				return fmt.Errorf("error parsing certificate: %v", err)
			}
		}
		*c = *r
		return nil
	}
	return fmt.Errorf("unknown format for Certificate: %q", string(b))
}

func (c *Certificate) MarshalJSON() ([]byte, error) {
	var data bytes.Buffer
	_, err := c.WriteTo(&data)
	if err != nil {
		return nil, fmt.Errorf("error writing SSL certificate: %v", err)
	}
	return json.Marshal(data.String())
}

func ParsePEMCertificate(pemData []byte) (*Certificate, error) {
	cert, err := parsePEMCertificate(pemData)
	if err != nil {
		return nil, err
	}

	c := &Certificate{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Store the certificate as a PEM string in the JSON field
2. If storing base64, ensure it is standard base64 of PEM data
3. Regenerate/serialize the certificate with kOps pki tooling so it emits PEM

When it happens

Trigger: Thrown at pkg/pki/certificate.go:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bc2c6c42b05e939d. Report an issue: GitHub.