verifying PKCS7 certificate chain with embedded intermediate

Error message

verifying PKCS7 certificate chain with embedded intermediates: %w

What it means

The signer certificate failed to chain to the trusted root using only the certificates embedded in the PKCS7 attestation, AND the PKCS7 already contained a matching issuer certificate — proving the chain is genuinely broken rather than merely missing an intermediate, so verification fails fast instead of fetching.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:212

	// The signature binds this content to the (still-untrusted) leaf, so it is safe to run
	// rejection-only checks (nonce, freshness) before paying for chain building or network fetches
	// below.
	data, err := parseAndValidateAttestedDocumentContent(p7.Content, body)
	if err != nil {
		return nil, err
	}

	// Verify using only the certificates embedded in the PKCS7 structure; if that succeeds, the signer
	// is trusted. If it fails but the PKCS7 already embeds a cert matching the signer's issuer, the
	// chain is genuinely broken (not just missing an intermediate), so fail fast instead of fetching.
	chainErr := verifySignerCertChain(signer, p7.Certificates, rootCertPool, x509.NewCertPool())
	if chainErr == nil {
		klog.V(2).Infof("PKCS7 certificate chain verified with embedded certificates for signer issuer %q", signer.Issuer)
		return data, nil
	}
	for _, cert := range p7.Certificates {
		if validateFetchedIntermediateForSigner(signer, cert) == nil {
			return nil, fmt.Errorf("verifying PKCS7 certificate chain with embedded intermediates: %w", chainErr)
		}
	}

	klog.V(4).Infof("Resolving intermediate certificates for signer issuer %q", signer.Issuer)
	intermediateCerts, err := fetchIntermediates(signer)
	if err != nil {
		return nil, fmt.Errorf("fetching intermediate certificates: %w", err)
	}
	if err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {
		return nil, fmt.Errorf("verifying PKCS7 certificate chain: %w", err)
	}
	klog.V(4).Infof("PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q", signer.Issuer)

	return data, nil
}

// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its
// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata

View on GitHub (pinned to 4c8573c808)

Solutions

Treat the attestation as untrusted; reject the token
Verify the embedded root pool includes the current Microsoft PKI roots (Microsoft may have rotated intermediates)
Update kops to pick up refreshed root certificates

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:212 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6a59a79a78f006f8. Report an issue: GitHub.