{"record":{"id":"086bab0625fba083","repo":"cloudflare/cloudflared","slug":"couldn-t-generate-the-secret-for-your-new-tunnel","errorCode":null,"errorMessage":"couldn't generate the secret for your new tunnel","messagePattern":"couldn't generate the secret for your new tunnel","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommand_context.go","lineNumber":136,"sourceCode":"\t\t\t\t\"You may have accidentally used the filepath to cert.pem, which is generated by `cloudflared tunnel \" +\n\t\t\t\t\"login`.\")\n\t\t}\n\t\treturn connection.Credentials{}, invalidJSONCredentialError{path: filePath, err: err}\n\t}\n\treturn credentials, nil\n}\n\nfunc (sc *subcommandContext) create(name string, credentialsFilePath string, secret string) (*cfapi.Tunnel, error) {\n\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"couldn't create client to talk to Cloudflare Tunnel backend\")\n\t}\n\n\tvar tunnelSecret []byte\n\tif secret == \"\" {\n\t\ttunnelSecret, err = generateTunnelSecret()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"couldn't generate the secret for your new tunnel\")\n\t\t}\n\t} else {\n\t\tdecodedSecret, err := base64.StdEncoding.DecodeString(secret)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Couldn't decode tunnel secret from base64\")\n\t\t}\n\t\ttunnelSecret = decodedSecret\n\t\tif len(tunnelSecret) < 32 {\n\t\t\treturn nil, errors.New(\"Decoded tunnel secret must be at least 32 bytes long\")\n\t\t}\n\t}\n\n\ttunnel, err := client.CreateTunnel(name, tunnelSecret)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"Create Tunnel API call failed\")\n\t}\n\n\tcredential, err := sc.credential()","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommand_context.go#L118-L154","documentation":"Raised in subcommandContext.create when no secret was supplied and generateTunnelSecret failed to produce random bytes for the new named tunnel. Tunnel creation cannot proceed without a secret, so `cloudflared tunnel create` and ad-hoc named tunnels fail at this step.","triggerScenarios":"secret == \"\" and crypto/rand read fails inside generateTunnelSecret during `cloudflared tunnel create`.","commonSituations":"Host entropy problems (very old kernels/containers without getrandom); restricted /dev/urandom in locked-down sandboxes; Go runtime CSPRNG initialization failures.","solutions":["Check that the host CSPRNG is available (getrandom syscall or /dev/urandom readable)","In containers, ensure /dev/urandom is not masked and seccomp allows getrandom","Pass an explicit secret instead: `--secret <base64 32+ bytes>` to skip generation","Reboot/upgrade the host kernel or container runtime if entropy syscalls fail"],"exampleFix":"// before\ncloudflared tunnel create mytunnel   # rand fails\n// after\nhead -c 32 /dev/urandom | base64 > secret.b64\ncloudflared tunnel create --secret \"$(cat secret.b64)\" mytunnel","handlingStrategy":"validation","validationCode":"// verify CSPRNG availability before generating secrets\nif f, err := os.Open(\"/dev/urandom\"); err != nil {\n    return fmt.Errorf(\"no entropy source available: %w\", err)\n} else {\n    _ = f.Close()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure containers allow the getrandom syscall","Supply --secret explicitly in locked-down environments","Keep kernels reasonably modern"],"tags":["go","crypto","random","cli"],"backgroundTag":"internal-invariant-violation","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}