kubernetes/kops · error

unrecognized certificate option: %v

Error message

unrecognized certificate option: %v

What it means

IssueCert parses the requested certificate type as a comma-separated token list; tokens beginning with "KeyUsage" are mapped through parseKeyUsage, and if a token starts with KeyUsage but is not a recognized name, the option is rejected. This guards against typo'd or unsupported key-usage strings silently producing certificates with missing usages.

Source

Thrown at pkg/pki/issue.go:84

// IssueCert issues a certificate, either a self-signed CA or from a CA in a keystore.
func IssueCert(ctx context.Context, request *IssueCertRequest, keystore Keystore) (issuedCertificate *Certificate, issuedKey *PrivateKey, caCertificate *Certificate, err error) {
	certificateType := request.Type
	if expanded, found := wellKnownCertificateTypes[certificateType]; found {
		certificateType = expanded
	}

	template := &x509.Certificate{
		BasicConstraintsValid: true,
		IsCA:                  false,
		SerialNumber:          request.Serial,
	}

	tokens := strings.Split(certificateType, ",")
	for _, t := range tokens {
		if strings.HasPrefix(t, "KeyUsage") {
			ku, found := parseKeyUsage(t)
			if !found {
				return nil, nil, nil, fmt.Errorf("unrecognized certificate option: %v", t)
			}
			template.KeyUsage |= ku
		} else if strings.HasPrefix(t, "ExtKeyUsage") {
			ku, found := parseExtKeyUsage(t)
			if !found {
				return nil, nil, nil, fmt.Errorf("unrecognized certificate option: %v", t)
			}
			template.ExtKeyUsage = append(template.ExtKeyUsage, ku)
		} else if t == "CA" {
			template.IsCA = true
		} else {
			return nil, nil, nil, fmt.Errorf("unrecognized certificate option: %q", t)
		}
	}

	template.Subject = request.Subject

	var alternateNames []string

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct the KeyUsage token to a supported name (e.g. KeyUsageDigitalSignature, KeyUsageKeyEncipherment, KeyUsageCertSign).
2. Check parseKeyUsage in pkg/pki/issue.go for the exact set of accepted usage names.
3. Remove the unsupported usage token if it is not needed for the certificate's role.

Example fix

// before
IssueCert(ctx, keystore, &IssueCertificateRequest{Type: "KeyUsageDigitalSignture,ExtKeyUsageServerAuth", ...})
// after
IssueCert(ctx, keystore, &IssueCertificateRequest{Type: "KeyUsageDigitalSignature,ExtKeyUsageServerAuth", ...})

func hasValidKeyUsage(certType string) bool {
    for _, t := range strings.Split(certType, ",") {
        if strings.HasPrefix(t, "KeyUsage") && parseKeyUsage(t) == (x509.KeyUsage(0)) {
            return false
        }
    }
    return true
}

When it happens

Trigger: Calling IssueCert with request.Type containing a token like "KeyUsageDigitalSignture" (typo) or "KeyUsageWhatever" — any token with prefix KeyUsage that parseKeyUsage cannot map.

Common situations: Typo in the certificate type string in cluster spec / TLS config, copying usage names not in Go's x509.KeyUsage set, or version drift where an expected usage name is unsupported.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• unrecognized certificate option: %q
• reading %q certificate: %v
• error issuing certificate: %v
• host %v did not have public-key
• failed to parse public key: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c0d5fc753236378c. Report an issue: GitHub.