goose serve did not emit TLS certificate fingerprint on ${st

Error message

goose serve did not emit TLS certificate fingerprint on ${statusUrl}.${exitDetails}${stderrDetails}

What it means

When TLS is enabled, startGooseServe waits not only for /status readiness but also for the server to emit its self-signed certificate fingerprint (used later for trust pinning). This error means readiness succeeded (or was skipped) but no fingerprint appeared within TLS_FINGERPRINT_TIMEOUT_MS; exit details and stderr are appended, and a 'fingerprint_missing' event is recorded in the startup trace.

Source

Thrown at ui/desktop/src/gooseServe.ts:582

  }

  if (tls) {
    startupTrace?.record('fingerprint_wait_start', { timeoutMs: TLS_FINGERPRINT_TIMEOUT_MS });
    const fingerprint = await waitForFingerprint(fingerprintReady, TLS_FINGERPRINT_TIMEOUT_MS);
    if (!fingerprint) {
      stopOutputCollection();
      await cleanup();
      const exitDetails = exited
        ? ` Process exited with code ${exitCode} and signal ${exitSignal}.`
        : '';
      const stderrDetails = errorLog.length ? ` Stderr: ${errorLog.join('\n')}` : '';
      startupTrace?.record('fingerprint_missing', {
        timeoutMs: TLS_FINGERPRINT_TIMEOUT_MS,
        exited,
        exitCode,
        exitSignal,
      });
      throw new Error(
        withStartupDiagnosticsPath(
          `goose serve did not emit TLS certificate fingerprint on ${statusUrl}.${exitDetails}${stderrDetails}`,
          startupDiagnosticsPath
        )
      );
    }
  }

  stopOutputCollection();

  return {
    acpUrl,
    workingDir,
    process: gooseProcess,
    errorLog,
    certFingerprint,
    cleanup,
    hasExited: () => exited,

View on GitHub (pinned to 3810898a74)

Solutions

Check the appended stderr and the 'fingerprint_wait_start'/'fingerprint_missing' events in the diagnostics file to see how far startup got
Verify TLS is enabled consistently: the same env that makes the client expect a fingerprint must make goose serve emit one
Update the goose binary so its fingerprint output matches what gooseServe.ts parses
If you intentionally run without TLS, disable it so this fingerprint wait is skipped entirely

Defensive patterns

Strategy: try-catch

Try / catch

try {
  result = await startGooseServe({ ...opts, tls: true });
} catch (e) {
  if (e instanceof Error && e.message.includes('did not emit TLS certificate fingerprint')) {
    // TLS contract mismatch: verify env parity and binary version; not retryable as-is
  }
  throw e;
}

Prevention

Set TLS env vars in one shared config object used by both client and server sides
Pin desktop app and goose binary to matching versions in CI
Record fingerprint_wait timing in diagnostics to distinguish 'slow' from 'never emitted'

When it happens

Trigger: goose serve version that prints the fingerprint in a different format/stream than expected; TLS enabled on the client while the server was started without TLS env (or vice versa); server becomes ready but the fingerprint writer (file or stdout) is missing; slow disk under diagnosticsDir delaying emission past the timeout.

Common situations: Version skew between desktop app and goose binary after a partial update; GOOSE_SERVER__TLS / TLS-related env set on only one side; CI runners without TLS support where the fingerprint is never emitted; stdout buffering swallowing the fingerprint line in dev mode.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of aaif-goose/goose@3810898a74 (2026-08-16). Data as JSON: /api/errors/1c9a220a738b5ed3. Report an issue: GitHub.