{"record":{"id":"045aabd313b0ca87","repo":"gohugoio/hugo","slug":"failed-to-verify-certificate-v","errorCode":null,"errorMessage":"failed to verify certificate: %v","messagePattern":"failed to verify certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"commands/server.go","lineNumber":747,"sourceCode":"\t\treturn fmt.Errorf(\"failed to parse root certificate\")\n\t}\n\n\tblock, _ := pem.Decode(certPEM)\n\tif block == nil {\n\t\treturn fmt.Errorf(\"failed to parse certificate PEM\")\n\t}\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse certificate: %v\", err.Error())\n\t}\n\n\topts := x509.VerifyOptions{\n\t\tDNSName: name,\n\t\tRoots:   roots,\n\t}\n\n\tif _, err := cert.Verify(opts); err != nil {\n\t\treturn fmt.Errorf(\"failed to verify certificate: %v\", err.Error())\n\t}\n\n\treturn nil\n}\n\nfunc (c *serverCommand) createServerPorts(cd *simplecobra.Commandeer) error {\n\tflags := cd.CobraCommand.Flags()\n\tvar cerr error\n\tc.withConf(func(conf *commonConfig) {\n\t\tisMultihost := conf.configs.IsMultihost\n\t\tc.serverPorts = make([]serverPortListener, 1)\n\t\tif isMultihost {\n\t\t\tif !c.serverAppend {\n\t\t\t\tcerr = errors.New(\"--appendPort=false not supported when in multihost mode\")\n\t\t\t\treturn\n\t\t\t}\n\t\t\tc.serverPorts = make([]serverPortListener, len(conf.configs.Languages))\n\t\t}","sourceCodeStart":729,"sourceCodeEnd":765,"githubUrl":"https://github.com/gohugoio/hugo/blob/52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2/commands/server.go#L729-L765","documentation":"`verifyCert` runs Go's `x509.Certificate.Verify` against the root pool and the requested hostname (`DNSName`). This wraps the verification failure, meaning the cert does not chain to the trusted root and/or the hostname/SAN does not match. `%v` is Go's verify error.","triggerScenarios":"Fires when the cached site cert was issued for a different hostname than the current `baseURL` hostname, the root CA differs from the one that signed it, or the cert has expired.","commonSituations":"Changing the server `baseURL`/hostname after generating certs (cert was for `localhost`, now serving `mysite.test`); a regenerated mkcert root CA invalidating older site certs; an expired cached cert.","solutions":["Delete the cached `_mkcerts/<hostname>.pem` and key so Hugo reissues for the current hostname.","Ensure `$CAROOT` points at the same root CA that signed the site cert.","Confirm the requested hostname matches a SAN in the cert (use `openssl x509 -text`).","Re-run `mkcert -install` to make sure the root is trusted system-wide."],"exampleFix":"// before\n// baseURL changed to https://myapp.test/ but cached cert is for localhost\n// after\n// rm -rf $cachedir/_mkcerts && hugo server --tlsAuto --baseURL=https://myapp.test/","handlingStrategy":"validation","validationCode":"import \"crypto/x509\"\nfunc validateCertForHost(certPEM, rootPEM []byte, host string) error {\n  roots := x509.NewCertPool()\n  if !roots.AppendCertsFromPEM(rootPEM) { return fmt.Errorf(\"bad root\") }\n  block, _ := pem.Decode(certPEM)\n  if block == nil { return fmt.Errorf(\"bad cert PEM\") }\n  cert, err := x509.ParseCertificate(block.Bytes)\n  if err != nil { return err }\n  opts := x509.VerifyOptions{DNSName: host, Roots: roots}\n  _, err = cert.Verify(opts)\n  return err\n}","typeGuard":"null","tryCatchPattern":"// If verify fails after a hostname change, reissue for the new host.\nif _, err := cert.Verify(opts); err != nil {\n  os.Remove(certFile); os.Remove(keyFile)\n  // next start provisions certs for the current hostname\n}","preventionTips":["When the server hostname changes, delete the `_mkcerts` cache so certs reissue.","Keep `$CAROOT` consistent with the CA that signed the site certs.","Verify cert SANs cover every hostname you serve."],"tags":["hugo","server","tls","x509","certificate"],"backgroundTag":null,"analyzedSha":"52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2","analyzedAt":"2026-08-09T21:49:36.660Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}