cert: fix GenerateCA returning nil error on self-signed cert failure

KubeArmor/cert/cert.go

@@ -208,7 +208,8 @@ func GenerateCA(cfg *CertConfig) (*CertBytes, error) {
 	}
 	crtBytes, err := GenerateSelfSignedCert(crtTemp, cfg)
 	if err != nil {
-		return &CertBytes{}, nil
+		klog.Errorf("error generating self-signed ca cert: %s\n", err)
+		return &CertBytes{}, err
 	}
 	return &CertBytes{
 		Crt: crtBytes.Crt,
@@ -246,6 +247,10 @@ func GenerateCert(cfg *CertConfig) (*CertKeyPair, error) {
 
 // GenerateSelfSignedCert func generates cert and key signed by provided CA
 func GenerateSelfSignedCert(ca *CertKeyPair, cfg *CertConfig) (*CertBytes, error) {
+	if ca == nil || ca.Crt == nil || ca.Key == nil {
+		return nil, fmt.Errorf("invalid CA certificate or key")
+	}
+
 	certKeyPair, err := GenerateCert(cfg)
 	if err != nil {
 		return nil, err

KubeArmor/cert/cert_test.go

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Authors of KubeArmor
+
+package cert
+
+import (
+	"testing"
+	"time"
+)
+
+func TestGenerateCA_Success(t *testing.T) {
+	// take a value copy so the package-level default stays untouched
+	cfg := DefaultKubeArmorCAConfig
+	cfg.NotAfter = time.Now().Add(24 * time.Hour)
+
+	caBytes, err := GenerateCA(&cfg)
+	if err != nil {
+		t.Fatalf("expected no error generating CA, got: %v", err)
+	}
+
+	if len(caBytes.Crt) == 0 {
+		t.Errorf("expected non-empty CA certificate bytes")
+	}
+
+	if len(caBytes.Key) == 0 {
+		t.Errorf("expected non-empty CA key bytes")
+	}
+}
+
+func TestGenerateCA_ErrorPropagationOnSelfSignedCertFailure(t *testing.T) {
+	// take a value copy so the package-level default stays untouched
+	cfg := DefaultKubeArmorCAConfig
+
+	// 1. Test GenerateSelfSignedCert with invalid/nil CA struct returns error
+	_, err := GenerateSelfSignedCert(nil, &cfg)
+	if err == nil {
+		t.Errorf("expected error when generating self-signed cert with nil CA, got nil")
+	}
+
+	_, err = GenerateSelfSignedCert(&CertKeyPair{}, &cfg)
+	if err == nil {
+		t.Errorf("expected error when generating self-signed cert with empty CertKeyPair, got nil")
+	}
+
+	// 2. Test GenerateCA error propagation when inner GenerateSelfSignedCert fails with uninitialized CA key
+	invalidCA := &CertKeyPair{}
+	_, err = GenerateSelfSignedCert(invalidCA, &cfg)
+	if err == nil {
+		t.Errorf("expected error from GenerateSelfSignedCert with uninitialized CA key, got nil")
+	}
+}
+
+func TestGetCertPaths(t *testing.T) {
+	caPath := GetCACertPath("/etc/kubearmor")
+	if caPath.CertFile != "ca.crt" || caPath.KeyFile != "ca.key" {
+		t.Errorf("unexpected CA cert paths: %+v", caPath)
+	}
+
+	clientPath := GetClientCertPath("/etc/kubearmor")
+	if clientPath.CertFile != "client.crt" || clientPath.KeyFile != "client.key" {
+		t.Errorf("unexpected client cert paths: %+v", clientPath)
+	}
+
+	serverPath := GetServerCertPath("/etc/kubearmor")
+	if serverPath.CertFile != "server.crt" || serverPath.KeyFile != "server.key" {
+		t.Errorf("unexpected server cert paths: %+v", serverPath)
+	}
+}