Repository navigation
Expired certificate combined with valid chain causes configuration stall #9225
Description
Description:
After upgrading from Envoy Gateway v1.7.3 to v1.7.4, TLS secrets containing a expired certificate and unexpired chain are rejected by Envoy with KEY_VALUES_MISMATCH, even though the private key correctly matches the certificate. It looks like the expired certificate gets removed but the chain is kept and it tries to match the private key to the chain certificate.
Because of this the complete configuration is invalid and gets rejected by Envoy. This causes configuration stall and envoy configurations don't get updated.
Repro steps:
1: Setup a gateway with a valid certificate
2: generate self signed invalid certificates
# Generate a CA (simulating intermediate)
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-384 \
-keyout ca-key.pem -out ca.pem -days 1 -nodes -subj "/CN=Fake Intermediate"
# Generate a cert signed by that CA and expired
openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
-keyout cert-key.pem -out cert-csr.pem -nodes -subj "/CN=test.example.com"
openssl x509 -req -in cert-csr.pem -CA ca.pem -CAkey ca-key.pem \
-CAcreateserial -out cert.pem -days 0
# Create chain file (certificate + intermediate)
cat cert.pem ca.pem > fullchain.pem
3: Replace the certificate with an expired one.
kubectl create secret tls <secret name> \
--cert=fullchain.pem \
--key=cert-key.pem \
-n <gateway-namespace>
Environment:
Envoy Gateway v1.7.4
Envoy Proxy v1.37.3
Logs:
Envoy rejected the last update with code 13 and message Failed to load private key from <inline>, Cause: error:0b000074:X.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH
Reacted by Bart Smits and Kevin Kupski
Activity
arkodg commentedon Jun 15, 2026
looks like #7909 removed the entire secret Ref for an expired cert, but #8744 brought it back
cc @cnvergence @kkk777-7