Diagnostic code

ZC-E0809

a certificate is malformed or outside the bounds

Kind

error

Blame

external

Exit code

3

What it means

A certificate was refused before its signature was looked at. Zigcube reads X.509 v3 strictly: DER only, Ed25519 only, a lifetime within the bound, at most x509_cert_bytes_max bytes. A certificate of this cluster also has one commonName, the extensions of its kind in a fixed order and a SPIFFE ID of the form spiffe://<cluster>/service/<name> (or one DNS name for a server). A server certificate under a pinned anchor of another CA may carry any names, key identifiers and extension order, but no unknown critical extension, no extension twice, and one DNS name or SPIFFE ID (docs/mtls.md).

The cause names the field and the rule it broke. A certificate that the cluster CA issued does not break any; if one does, it did not come from zcube (another CA, a hand-made file) or it was damaged on the way.

Ask for a new certificate from the cluster CA, or from the anchor's CA with the profile docs/mtls.md describes.

Offline

The same text, without a network:

zcube explain E0809