<p>I'm trying to use kubectl exec to enter one of my containers, but I'm getting stuck on this error.</p>

<pre><code>$ kubectl exec -it ubuntu -- bash
error: Unable to upgrade connection: {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "x509: cannot validate certificate for &lt;worker_node_ip&gt; because it doesn't contain any IP SANs",
    "code": 500
}
</code></pre>

<p>I have configured kubectl with my CA certificate and admin keys, etc according to this guide <a href="https://coreos.com/kubernetes/docs/1.0.6/configure-kubectl.html" rel="noreferrer">https://coreos.com/kubernetes/docs/1.0.6/configure-kubectl.html</a></p>

<h2>Update</h2>

<p>I also found the same error in the API server's logs</p>

<pre><code>E1125 17:33:16.308389 1 errors.go:62] apiserver received an error that is not an unversioned.Status: x509: cannot validate certificate for &lt;worker_node_ip&gt; because it doesn't contain any IP SANs
</code></pre>

<p>Does this mean I have configured the certs incorrectly on my worker/master nodes or on kubectl on my local machine?</p>

<p>If you used this command to create your certificate:</p>

<pre><code>openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem \
    -CAcreateserial -out server-cert.pem
</code></pre>

<p>Then your issue can be resolved by doing the following as the 'client' cert uses an -extfile extfile.cnf:</p>

<pre><code>echo subjectAltName = IP:worker_node_ip &gt; extfile.cnf
openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial \
   -out server-cert.pem -extfile extfile.cnf
</code></pre>

<p>You can specify any number of IP addresses, such as IP:127.0.0.1,IP:127.0.1.1 (non localhost as well).</p>
