kubernetes/kops · error

verifying PKCS7 certificate chain: %w

Error message

verifying PKCS7 certificate chain: %w

What it means

After successfully fetching intermediate certificates, the signer certificate still failed to chain to the trusted root. The attestation is cryptographically unverifiable against the configured Microsoft root pool.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:222

	// chain is genuinely broken (not just missing an intermediate), so fail fast instead of fetching.
	chainErr := verifySignerCertChain(signer, p7.Certificates, rootCertPool, x509.NewCertPool())
	if chainErr == nil {
		klog.V(2).Infof("PKCS7 certificate chain verified with embedded certificates for signer issuer %q", signer.Issuer)
		return data, nil
	}
	for _, cert := range p7.Certificates {
		if validateFetchedIntermediateForSigner(signer, cert) == nil {
			return nil, fmt.Errorf("verifying PKCS7 certificate chain with embedded intermediates: %w", chainErr)
		}
	}

	klog.V(4).Infof("Resolving intermediate certificates for signer issuer %q", signer.Issuer)
	intermediateCerts, err := fetchIntermediates(signer)
	if err != nil {
		return nil, fmt.Errorf("fetching intermediate certificates: %w", err)
	}
	if err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {
		return nil, fmt.Errorf("verifying PKCS7 certificate chain: %w", err)
	}
	klog.V(4).Infof("PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q", signer.Issuer)

	return data, nil
}

// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its
// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata
// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call
// before triggering intermediate certificate fetches.
func parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {
	if signature == "" {
		return nil, nil, fmt.Errorf("empty PKCS7 signature")
	}

	sigBytes, err := base64.StdEncoding.DecodeString(signature)
	if err != nil {
		return nil, nil, fmt.Errorf("decoding PKCS7 signature: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation token
2. Verify the verifier's root pool contains the current Microsoft PKI root CAs
3. Update kops if Microsoft rotated its PKI

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:222 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e12fa3d6d0775ed7. Report an issue: GitHub.