kubernetes/kops · error

unrecognized certificate option: %q

Error message

unrecognized certificate option: %q

What it means

The final branch of IssueCert's certificate-type parser: any token that is not a KeyUsage*, ExtKeyUsage*, or the literal "CA" is rejected with a quoted error. This is the catch-all for malformed certificate type strings.

Source

Thrown at pkg/pki/issue.go:96

	tokens := strings.Split(certificateType, ",")
	for _, t := range tokens {
		if strings.HasPrefix(t, "KeyUsage") {
			ku, found := parseKeyUsage(t)
			if !found {
				return nil, nil, nil, fmt.Errorf("unrecognized certificate option: %v", t)
			}
			template.KeyUsage |= ku
		} else if strings.HasPrefix(t, "ExtKeyUsage") {
			ku, found := parseExtKeyUsage(t)
			if !found {
				return nil, nil, nil, fmt.Errorf("unrecognized certificate option: %v", t)
			}
			template.ExtKeyUsage = append(template.ExtKeyUsage, ku)
		} else if t == "CA" {
			template.IsCA = true
		} else {
			return nil, nil, nil, fmt.Errorf("unrecognized certificate option: %q", t)
		}
	}

	template.Subject = request.Subject

	var alternateNames []string
	alternateNames = append(alternateNames, request.AlternateNames...)

	for _, san := range alternateNames {
		san = strings.TrimSpace(san)
		if san == "" {
			continue
		}
		if ip := net.ParseIP(san); ip != nil {
			template.IPAddresses = append(template.IPAddresses, ip)
		} else {
			template.DNSNames = append(template.DNSNames, san)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use only recognized tokens: KeyUsage*, ExtKeyUsage*, or "CA".
2. Remove empty tokens caused by stray/trailing commas in the Type string.
3. Check pkg/pki/issue.go IssueCert for the exact grammar of the Type field.

Example fix

// before
Type: "KeyUsageDigitalSignature,CA,"
// after
Type: "KeyUsageDigitalSignature,CA"

func isValidCertType(certType string) bool {
    for _, t := range strings.Split(certType, ",") {
        t = strings.TrimSpace(t)
        if t == "" { return false }
        if !strings.HasPrefix(t, "KeyUsage") && !strings.HasPrefix(t, "ExtKeyUsage") && t != "CA" {
            return false
        }
    }
    return true
}

When it happens

Trigger: Calling IssueCert with request.Type containing an arbitrary token like "server" or "dns:" (empty/whitespace tokens also land here, e.g. from a trailing comma).

Common situations: Typos like "Ca" instead of "CA", stray commas producing empty tokens, or passing names from a different PKI tool's syntax.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• unrecognized certificate option: %v
• reading %q certificate: %v
• error issuing certificate: %v
• host %v did not have public-key
• failed to parse public key: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7cc4712d7810489e. Report an issue: GitHub.