x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs

The address is the dialed one. When the certificate has some IP SANs but not this address, Go says "x509: certificate is valid for <ips>, not <ip>" instead. TLS dials add the "tls: failed to verify certificate: " prefix.

Go crypto/x509 — HostnameError when the target is an IP address and the certificate has DNS SANs only

What it means

The client dialed an IP address, so Go must find that address among the certificate's IP SAN entries, but the certificate contains DNS names only. Go never matches an IP address against DNS names or the Common Name. The address in the message is the one your client connected to.

Why it happens

• The client uses an IP address in the URL

  common

  Configuration with raw addresses, service discovery returning IPs, or health checks against node addresses.

• A Kubernetes API server reached through a new address

  common

  Accessing the cluster through a load balancer, floating IP or node address that was not passed to kubeadm as an extra SAN.

• The IP address was put into the Common Name

  occasional

  CN=10.0.0.5 is ignored; the address must be an IP entry in subjectAltName.

How to fix it

1. 1.

   Keep the address, verify the name

   Set tls.Config.ServerName to a DNS name from the certificate. Go then verifies that name and sends it as SNI while connecting to the address.

   // Dial the address, verify the certificate's DNS name (also sent as SNI)
   transport := &http.Transport{TLSClientConfig: &tls.Config{ServerName: "api.example.com"}}
   client := &http.Client{Transport: transport}
   resp, err := client.Get("https://10.0.0.5:443/healthz")

2. 2.

   Add the address as an IP SAN

   Private CAs can issue certificates with IP entries; public CAs rarely do.

   # Or put the address into the certificate as an IP SAN
   openssl req -new -key server.key -out server.csr -subj "/CN=api.example.com" \
     -addext "subjectAltName=DNS:api.example.com,IP:10.0.0.5"

3. 3.

   Kubernetes: add the address to the API server certificate

   Pass extra SANs at kubeadm init (or regenerate the apiserver certificate with the new SANs) and distribute an updated kubeconfig.

   # Kubernetes API server reached by a new IP (load balancer, node address)
   kubeadm init --apiserver-cert-extra-sans=10.0.0.5,k8s.example.com
   openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -ext subjectAltName

← Browse the full signature error database